$hell on Earth

GetIntegerString returns the value of aValue after casting it to a 32-bit integer:
JavascriptString* ScriptContext::GetIntegerString(Var aValue)
{
return this->GetIntegerString(TaggedInt::ToInt32(aValue));
}
Based on that information, the lower 32-bit of the current object’s address can be obtained through the
TypeIds_Integer case.
The higher 32-bit of the address can be figured out using the TypeIds_UInt64Number type, which returns
a 64-bit value that is located at aValue+0x10.
The DataView objects memory was freed and filled with NativeFloatArray objects. As long as the size
of NativeFloatArray is small, elements for the array are created next to each other. Then, fake DataView
objects were created to perform read/write from the process memory.
In order to bypass CFG, this chain used a setjmp call to obtain the stack address and overwrite the return
address.
CVE-2016-0191 Patch
Microsoft already had a function that returns undefined. Instead, the wrong function was used, and that
function can end up with an uninitialized subItem.
For the fix, Microsoft basically used the right GetItem definition:
if (JavascriptOperators::HasItem(itemObject, idxSubItem))
{
subItem = JavascriptOperators::GetItem(itemObject, idxSubItem,
scriptContext);
if (pDestArray)
{
pDestArray->DirectSetItemAt(idxDest, subItem);
In case GetItem fails, it will return undefined in subItem.
51 | <strong>$hell</strong> on Earth: From Browser to System Compromise