vendor:
Chromium
by:
Project Zero
7,5
CVSS
HIGH
Out-of-bounds write
787
CWE
Product Name: Chromium
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Linux
2018
Out-of-bounds write in JSObject::ensureLength
JSObject::ensureLength is vulnerable to an out-of-bounds write. The function is called whether ensureLengthSlow failed or not, which results in an OOB access. The PoC code creates an array of length 0x200000 and then tries to increase its length to 0x1000000. This causes an OOB write, which can be used to leak memory.
Mitigation:
No known mitigation is available.
