Security: Javascript history.pushState() Memory Corruption / Exhaustion
Reported by
fdhi...@gmail.com,
Oct 23 2016
|
||
Issue descriptionVULNERABILITY DETAILS Javascript::history.pushState() memory corruption that results in an extensive amount of system memory being used. Through my tests, over 2.5GB of memory was used, and rising, within 10 seconds of running the vulnerability resulting in a crash or complete, temporary, freezing of the system until process is force killed, if possible, or reboot is required. CPU Usage seems to increase as well, in my case running an octa-core i7 at 2.50ghz , over 50% of CPU was being exhausted. VERSION Chrome Version: 54.0.2840.71 m (latest stable) Operating System: Windows 10, x86 (32bit) REPRODUCTION CASE Attached are all necessary Files in a zip archive and i also attached them separately, in case the archive is a security issue. Simply click on "Launch" to start, Code is clear and not obfuscated. Note: Files need to either be hosted online or on local server (example: Xampp) to work. Type of crash: browser / System (depending on memory resources)
,
Oct 24 2016
Can you explain why you believe there's "Memory corruption" as opposed to simple exhaustion? The hang/OOM exit appears to be dupe of Issue 489470 and/or Issue 648333.
,
Oct 24 2016
Agreed that this doesn't appear to be memory corruption, but rather only a denial of service. Thanks for the report either way, it still helps us. |
||
►
Sign in to add a comment |
||
Comment 1 by fdhi...@gmail.com
, Oct 23 2016