|
|
MsMpEng: UAF via saved callers | ||||
| Project Member Reported by lokihardt@google.com, May 12 2017 | Back to list | ||||
In JsRuntimeState::setCaller, it saves the current caller in the JsRuntimeState object(rcx+158h in 64-bit). But the garbage collector doesn't mark this saved value. So it results in a UAF. Unlike in our test environment(Linux), it doesn't make reliable crashes on Windows. So I used another bug(#1258) to confirm the bug. If the UAF bug doesn't exist, the "crash" function will not be called(See poc.js). The password of the zip file is "calleruaf" This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public.
Project Member
Comment 1
by
lokihardt@google.com,
May 20 2017
,
May 25 2017
From what I can tell, Microsoft silently patched this yesterday in mpengine 1.1.13804.0. They also fixed issue 1258 , issue 1259 , issue 1260 and issue 1261 .
,
May 30 2017
,
May 30 2017
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8541 |
|||||
| ► Sign in to add a comment | |||||
