vendor:
V8
by:
Chromium
8.8
CVSS
HIGH
Type Confusion
843
CWE
Product Name: V8
Affected Version From: V8 version 8.4.371.18
Affected Version To: V8 version 8.4.371.19
Patch Exists: YES
Related CWE: CVE-2020-6418
CPE: a:chromium:v8
Metasploit:
https://www.rapid7.com/db/vulnerabilities/redhat_linux-cve-2020-6418/, https://www.rapid7.com/db/vulnerabilities/microsoft-edge-cve-2020-6418/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2020-6418/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2020-6418/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2020-6418/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2020-6418/, https://www.rapid7.com/db/vulnerabilities/google-chrome-cve-2020-6418/
Other Scripts:
N/A
Platforms Tested: All
2020
Object.create Type Confusion Vulnerability
The Object.create() function in V8 JavaScript engine is vulnerable to type confusion. The vulnerability is caused by a check that fails to guarantee that the prototype given as the parameter is 'null'. This can lead to type confusion when Map::GetObjectCreateMap is called with the prototype, allowing an attacker to transition the prototype and cause type confusion.
Mitigation:
Upgrade to V8 version 8.4.371.19 or later.
