17-11 Security Update #4226

leirocks · 2017-11-14T18:03:24Z

17-11 Security Update that addresses the following issues in ChakraCore

CVE-2017-11791
CVE-2017-11836
CVE-2017-11837
CVE-2017-11838
CVE-2017-11840
CVE-2017-11841
CVE-2017-11843
CVE-2017-11846
CVE-2017-11858
CVE-2017-11861
CVE-2017-11862
CVE-2017-11870
CVE-2017-11871
CVE-2017-11873
CVE-2017-11874
CVE-2017-11866

…:VEval function - Individual do not use eval map if we are eval-ing PropertyString

…hoo 360

…f a javascript null scope object. - Internal

…turn the return instruction - Google, Inc.

…o RCE - Zero Day Initiative Fix *::TransferPass0 overflowing the returning integer, the allocation part is the only point that using the returning value.

…ontrolled allocation size and write - Individual When parsing a string template literal, we temporarily suspend updating some of the offset counters. If an attacker crafts a string template that contains multibyte characters, it is possible to overflow the minLine counter. The attacker can directly control the size of the overflow, which is then used in an allocation and offset calculation when handling a parse error. Further control can be gained by triggering a scanner capture and restore to propagate this bad counter value. Unfortunately this would have been caught by existing bounds checks, but they are asserts only. There are other instances of these around the codebase, but I did not see any exploits for those. To fix this, we manually update the minLine counter at the point where it would normally have been updated outside of a string template. I also changed the subtraction overflow asserts to be failfasts and added an assert for detecting overflow with multibyte characters. In the non-assert case, we will return 0. Other similar checks in IchMinTok and IchLimTok have also been converted.

MSLaguana

Version number change looks good.

leirocks · 2017-11-14T19:55:05Z

fixed "BackEnd.h" with "Backend.h"

rajatd

MSLaguana · 2017-11-14T21:38:33Z

lib/Runtime/Language/JavascriptOperators.cpp

@@ -4772,64 +4772,45 @@ namespace Js
        return returnValue;
    }

+    template<typename T, typename T(*func)(Var, ScriptContext*)> bool MemsetConversion(Var value, ScriptContext* scriptContext, T* result)


clang is complaining about this line, it doesn't seem to like the typename T(*func)(Var, ScriptContext*)

�[1m/mnt/j/w/Microsoft_ChakraCore/release_1.7/shared_ubuntu_linux_debug_prtest/lib/Runtime/Language/JavascriptOperators.cpp:4775:35: �[0m�[0;1;31merror: �[0m�[1mexpected a qualified name after 'typename' [-Werror]�[0m 12:35:58 template<typename T, typename T(*func)(Var, ScriptContext*)> bool MemsetConversion(Var value, ScriptContext* scriptContext, T* result)

akroshg

MSLaguana · 2017-11-14T22:32:51Z

@dotnet-bot test OSX static_osx_osx_debug please

…P_Memset: Type Confusion - Google, Inc.

…String's buffer could cause UAF.

…er IsLoopPrePass properly - Google, Inc.

…llocation - Google, Inc.

…lead to RCE - Individual

… check in Lowerer::LowerBoundCheck - Google, Inc. Math on IntConstType should be bounded by IRType of the Opnd. In case of Lowerer::LowerBoundCheck, it ended up that the IntConstOpnd is a TyInt32 and the overflow leads to bad bound check being emitted. For this I added a new IntConstMath class which takes an IRType as a parameter and validates that the result can be represented by that IRType.

… Qihoo 360 OOM in the Array.Shift method have left the array in the bad state and later it got overlapped and exploited. Fixed that by making the any exception as failfast in that region

…vidual Export was not taking care of destructuring nodes, leading to type confusion. Fixed that by adding support for walking those nodes.

…en for function objects with inline cache When trying to get inlineCaches for a ScriptFunctionWithInlineCache if the function got redefered and didn't got reparsed function body won’t be there (hence no inlineCache on function body). Check that and reset the inlineCache of ScriptFunctionWithInlineCache for such case.

… Internal

leirocks · 2017-11-14T23:18:29Z

fix build break in clang:
template<typename T, typename T(func)(Var, ScriptContext)>
==> template<typename T, T(func)(Var, ScriptContext)>

leirocks · 2017-11-15T00:56:31Z

@dotnet-bot test OSX static_osx_osx_debug please

leirocks · 2017-11-15T01:20:16Z

@dotnet-bot test Ubuntu shared_ubuntu_linux_debug please

MSLaguana · 2017-11-15T05:59:30Z

Looks like the test timeout failure isn't just OSX, it's also happening on linux debug builds:

18:33:26 
ERROR: Test timed out!
18:33:26 /mnt/j/w/Microsoft_ChakraCore/release_1.7/static_ubuntu_linux_debug_prtest/out/Debug/ch -WERExceptionSupport -ExtendedErrorStackForTestHost -BaselineMode -forceNative -off:simpleJit -bgJitDelay:0 -dynamicprofileinput:profile.dpl.793 -off:deferparse /mnt/j/w/Microsoft_ChakraCore/release_1.7/static_ubuntu_linux_debug_prtest/test/Function/FuncBody.bug232281.js

… eval on property will be slower, especially in debug build. here empty string or single char string is backed by property string (an optimazation for using inline buffer), and these two tests keep eval on empty string until stack overflow, which causes timeout on debug build. changing to eval on two spaces instead of empty string to avoid the issue

Merge pull request #4226 from leirocks:1711-1 17-11 Security Update that addresses the following issues in ChakraCore CVE-2017-11791 CVE-2017-11836 CVE-2017-11837 CVE-2017-11838 CVE-2017-11840 CVE-2017-11841 CVE-2017-11843 CVE-2017-11846 CVE-2017-11858 CVE-2017-11861 CVE-2017-11862 CVE-2017-11870 CVE-2017-11871 CVE-2017-11873 CVE-2017-11874 CVE-2017-11866 CVE-2017-11859

leirocks and others added 6 commits November 12, 2017 14:11

[CVE-2017-11843] Edge - UAF in chakra the bug is in Js::GlobalObject:…

14f44de

…:VEval function - Individual do not use eval map if we are eval-ing PropertyString

[CVE-2017-11837] [ChakraCore] Edge - TypedArray UaF leads to RCE - Qi…

38a37ac

…hoo 360

[CVE-2017-11870] Edge - Exploitable write-AV when writing to a slot o…

b44ee83

…f a javascript null scope object. - Internal

[CVE-2017-11841] JIT: Inline::InlineCallApplyTarget_Shared doesn't re…

f8098c2

…turn the return instruction - Google, Inc.

[CVE-2017-11858] Chakra - Regular Expression Integer Overflow Leads t…

b54e0d6

…o RCE - Zero Day Initiative Fix *::TransferPass0 overflowing the returning integer, the allocation part is the only point that using the returning value.

MSLaguana approved these changes Nov 14, 2017

View reviewed changes

MikeHolman approved these changes Nov 14, 2017

View reviewed changes

leirocks force-pushed the 1711-1 branch from 7b6a194 to 08e1bf0 Compare November 14, 2017 19:51

rajatd approved these changes Nov 14, 2017

View reviewed changes

meg-gupta approved these changes Nov 14, 2017

View reviewed changes

MSLaguana reviewed Nov 14, 2017

View reviewed changes

akroshg approved these changes Nov 14, 2017

View reviewed changes

agarwal-sandeep approved these changes Nov 14, 2017

View reviewed changes

Cellule and others added 10 commits November 14, 2017 15:09

[CVE-2017-11873] Edge - Chakra: JIT: Bailouts must be generated for O…

a8d64f1

…P_Memset: Type Confusion - Google, Inc.

[CVE-2017-11791] Fix code patterns where accessing a local Javascript…

2c9654e

…String's buffer could cause UAF.

[CVE-2017-11840] [ChakraCore]: JIT: GlobOpt::OptTagChecks must consid…

874551d

…er IsLoopPrePass properly - Google, Inc.

[CVE-2017-11874] [ChakraCore]: CFG bypass due to a bug in ServerFreeA…

5a4e655

…llocation - Google, Inc.

[CVE-2017-11838] [ChakraCore] - JIT optimization vulnerability could …

c1bdfff

…lead to RCE - Individual

[CVE-2017-11846] [ChakraCore]- Chakra Array.Shift Heap Overflow RCE -…

3f8cc2d

… Qihoo 360 OOM in the Array.Shift method have left the array in the bad state and later it got overlapped and exploited. Fixed that by making the any exception as failfast in that region

[CVE-2017-11862] [ChakraCore] Type confusion in module exports - Indi…

66d733b

…vidual Export was not taking care of destructuring nodes, leading to type confusion. Fixed that by adding support for walking those nodes.

[CVE-2017-11859] Chakra - Type confusion in OOP JIT context handles -…

dcf8c7a

… Internal

leirocks force-pushed the 1711-1 branch from 08e1bf0 to 8af5bab Compare November 14, 2017 23:15

leirocks added 2 commits November 15, 2017 15:27

Update ChakraCore version to 1.7.4

1be2d26

leirocks force-pushed the 1711-1 branch from 8af5bab to 1be2d26 Compare November 15, 2017 23:28

chakrabot merged commit 1be2d26 into chakra-core:release/1.7 Nov 16, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

17-11 Security Update #4226

17-11 Security Update #4226

leirocks commented Nov 14, 2017 •

edited

Loading

MSLaguana left a comment

leirocks commented Nov 14, 2017

rajatd left a comment

MSLaguana Nov 14, 2017

akroshg left a comment

MSLaguana commented Nov 14, 2017

leirocks commented Nov 14, 2017

leirocks commented Nov 15, 2017

leirocks commented Nov 15, 2017

MSLaguana commented Nov 15, 2017

17-11 Security Update #4226

17-11 Security Update #4226

Conversation

leirocks commented Nov 14, 2017 • edited Loading

MSLaguana left a comment

Choose a reason for hiding this comment

leirocks commented Nov 14, 2017

rajatd left a comment

Choose a reason for hiding this comment

MSLaguana Nov 14, 2017

Choose a reason for hiding this comment

akroshg left a comment

Choose a reason for hiding this comment

MSLaguana commented Nov 14, 2017

leirocks commented Nov 14, 2017

leirocks commented Nov 15, 2017

leirocks commented Nov 15, 2017

MSLaguana commented Nov 15, 2017

leirocks commented Nov 14, 2017 •

edited

Loading