Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

February 2019 Security Update #5936

Merged
merged 13 commits into from
Feb 12, 2019

Conversation

MikeHolman
Copy link
Contributor

@MikeHolman MikeHolman commented Feb 12, 2019

MikeHolman and others added 12 commits February 7, 2019 11:31
…n a split scope (a function has both a param and body scope), then it is required that the body and param scope are marked as both requiring either a scope object or a scope slot. This was not being enforced in Scope::SetIsObject(). This led to an AV in the interpreter when accessing a property because StLocalSlot was used instead of StLocalObjSlot.
…romise result

    I also added mitigations for bad things that can happen when calling into a closed script context.
    1. We delete xdata before unregistering it, which can lead to UAF if we call address of a closed function. Windows Exception code unconditionally jumps to handler address (i.e. without CFG check), so this can bypass CFG. I changed to delete after unregistering.
    2. We zero code pages when we close script context, which could be exploitable on x86. I changed to fill with debugbreak.
@MikeHolman
Copy link
Contributor Author

Failures all seem infra related. I'm going to merge despite them to get release going.

@chakrabot chakrabot merged commit a54c9cb into chakra-core:release/1.11 Feb 12, 2019
chakrabot pushed a commit that referenced this pull request Feb 12, 2019
chakrabot pushed a commit that referenced this pull request Feb 12, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants