Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ChakraCore 2018-05 security updates #5116

Merged
merged 14 commits into from
May 8, 2018
Merged

ChakraCore 2018-05 security updates #5116

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift click to select a range
87f3367
[CVE-2018-0945] Chakra - Crashing on a null deref - Individual
Apr 11, 2018
ee5dfab
[CVE-2018-8139] Edge - Chakra type confusion in boundfunction handlin…
MSLaguana Apr 11, 2018
6e362fe
[CVE-2018-8137] Edge - chakra JIT array out of bound read/write vulne…
sigatrev Apr 18, 2018
c8f723d
[CVE-2018-8178] Edge - Incorrect entry point expiration can cause RCE…
pleath Apr 18, 2018
23848b1
[CVE-2018-8128] Edge - UAF of borrowed inline caches after redeferral
pleath Apr 18, 2018
eb4b00b
[CVE-2018-8177] Edge - Speculative type confusion on PropertyString
sethbrenith Apr 23, 2018
e664e18
Add masking of stores for protection against Spectre.
Penguinwizzard Apr 19, 2018
bee1e24
[CVE-2018-8130] [CVE-2018-0946] move allocators to ServerScriptContex…
MikeHolman Mar 20, 2018
71d7b38
[CVE-2018-0953] Edge Chakra - JIT: Magic value can cause type confusi…
rajatd Apr 26, 2018
32ee5de
[CVE-2018-0943]: Chakra Bug 15964039 - Unrestored bytecode register a…
rajatd Apr 26, 2018
1b56f9f
[CVE-2018-8133] Edge - Chakra: Type confusion with EntrySimpleObjectS…
akroshg May 1, 2018
28928cb
[CVE-2018-1022] Inline segment is passed to another array - Internal
akroshg May 1, 2018
51c4637
[CVE-2018-0954] Report a stack variable uaf bug to Edge Bug Bounty - …
agarwal-sandeep May 2, 2018
ec2922b
Bumping version prior to release
MSLaguana May 8, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
[CVE-2018-8137] Edge - chakra JIT array out of bound read/write vulne… 
…rability lead to Remote Code Execution
  • Loading branch information
@sigatrev @MSLaguana
sigatrev authored and MSLaguana committed May 8, 2018
commit 6e362fe94bc4bba7c8b8c6f819c1bee94c51893c
24 changes: 4 additions & 20 deletions lib/Backend/GlobOpt.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6482,6 6482,8 @@ GlobOpt::OptConstPeep(IR::Instr *instr, IR::Opnd *constSrc, Value **pDstVal, Val

instr->m_opcode = Js::OpCode::Ld_A;

InvalidateInductionVariables(instr);

return true;
}

Expand Down Expand Up @@ -7088,16 7090,7 @@ GlobOpt::OptConstFoldUnary(
}
}

// If this is an induction variable, then treat it the way the prepass would have if it had seen
// the assignment and the resulting change to the value number, and mark it as indeterminate.
for (Loop * loop = this->currentBlock->loop; loop; loop = loop->parent)
{
InductionVariable *iv = nullptr;
if (loop->inductionVariables && loop->inductionVariables->TryGetReference(dstSym->m_id, &iv))
{
iv->SetChangeIsIndeterminate();
}
}
InvalidateInductionVariables(instr);

return true;
}
Expand Down Expand Up @@ -12422,16 12415,7 @@ GlobOpt::OptConstFoldBinary(
this->ToInt32Dst(instr, dst->AsRegOpnd(), this->currentBlock);
}

// If this is an induction variable, then treat it the way the prepass would have if it had seen
// the assignment and the resulting change to the value number, and mark it as indeterminate.
for (Loop * loop = this->currentBlock->loop; loop; loop = loop->parent)
{
InductionVariable *iv = nullptr;
if (loop->inductionVariables && loop->inductionVariables->TryGetReference(dstSym->m_id, &iv))
{
iv->SetChangeIsIndeterminate();
}
}
InvalidateInductionVariables(instr);

return true;
}
Expand Down
1 change: 1 addition & 0 deletions lib/Backend/GlobOpt.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -685,6 685,7 @@ class GlobOpt
void DetectUnknownChangesToInductionVariables(GlobOptBlockData *const blockData);
void SetInductionVariableValueNumbers(GlobOptBlockData *const blockData);
void FinalizeInductionVariables(Loop *const loop, GlobOptBlockData *const headerData);
void InvalidateInductionVariables(IR::Instr * instr);
enum class SymBoundType {OFFSET, VALUE, UNKNOWN};
SymBoundType DetermineSymBoundOffsetOrValueRelativeToLandingPad(StackSym *const sym, const bool landingPadValueIsLowerBound, ValueInfo *const valueInfo, const IntBounds *const bounds, GlobOptBlockData *const landingPadGlobOptBlockData, int *const boundOffsetOrValueRef);

Expand Down
24 changes: 24 additions & 0 deletions lib/Backend/GlobOptIntBounds.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1262,6 1262,30 @@ void GlobOpt::FinalizeInductionVariables(Loop *const loop, GlobOptBlockData *con
}
}

void
GlobOpt::InvalidateInductionVariables(IR::Instr * instr)
{
Assert(instr->GetDst() != nullptr && instr->GetDst()->IsRegOpnd());

// Induction variables are always var syms.
StackSym * dstSym = instr->GetDst()->AsRegOpnd()->m_sym;
if (!dstSym->IsVar())
{
dstSym = dstSym->GetVarEquivSym(this->func);
}

// If this is an induction variable, then treat it the way the prepass would have if it had seen
// the assignment and the resulting change to the value number, and mark it as indeterminate.
for (Loop * loop = this->currentBlock->loop; loop; loop = loop->parent)
{
InductionVariable *iv = nullptr;
if (loop->inductionVariables && loop->inductionVariables->TryGetReference(dstSym->m_id, &iv))
{
iv->SetChangeIsIndeterminate();
}
}
}

GlobOpt::SymBoundType GlobOpt::DetermineSymBoundOffsetOrValueRelativeToLandingPad(
StackSym *const sym,
const bool landingPadValueIsLowerBound,
Expand Down