$hell on Earth

Microsoft Edge Vulnerability to Kernel Execution by
Tencent Security Team Sniper
Team Sniper’s chain was composed of an out-of-bounds access vulnerability exploited in Microsoft Edge,
chained with a kernel exploit that achieved local privilege escalation.
CVE-2016-0193 – Microsoft Edge JavaScript Fill Out-Of-Bounds Access
From Chakra:
Var JavascriptArray::EntryFill(RecyclableObject* function, CallInfo callInfo,
...)
{
....
// In ES6-mode, we always load the length property from the
object instead of using the internal slot.
// Even for arrays, this is now observable via proxies.
// If source object is not an array, we fall back to this
behavior anyway.
Var lenValue = JavascriptOperators::OP_GetLength(obj,
scriptContext);
length = JavascriptConversion::ToLength(lenValue, scriptContext);
}
return JavascriptArray::FillHelper(pArr, nullptr, obj, length, args,
scriptContext);
}
The length is fetched from the length property, which can be overwritten in certain cases.
54 | <strong>$hell</strong> on Earth: From Browser to System Compromise