This repository has been archived by the owner on Apr 22, 2023. It is now read-only.
v8: backport fix for CVE-2013-6639 and CVE-2013-6640 #6698
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Thank you for contributing this pull request! Here are a few pointers to make sure your submission will be considered for inclusion. Commit tchollingsworth/node@09a9b8e has the following error(s):
The following commiters were not found in the CLA: You can fix all these things without opening another issue. Please see CONTRIBUTING.md for more information |
Quoting CVE-2013-6639: The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via JavaScript code that sets the value of an array element with a crafted index. Quoting CVE-2013-6640: The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that sets a variable to the value of an array element with a crafted index. Like 6b92a7, this is unlikely to affect node.js because it only runs local, trusted code. However, if there exists some module somewhere that populates an array index with remotely provided data this could very well be used to crash a remote server running node. Defense in depth and all. This is a backport of upstream commit r17801. Original commit log: Limit size of dehoistable array indices LOG=Y BUG=chromium:319835,chromium:319860 R=dslomov@chromium.org Review URL: https://codereview.chromium.org/74113002
|
Landed through merge, will do a clean update in master. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Quoting CVE-2013-6639:
Quoting CVE-2013-6640:
Like 6b92a7, this is unlikely to affect node.js because it only runs local,
trusted code. However, if there exists some module somewhere that populates
an array index with remotely provided data this could very well be used to crash
a remote server running node. Defense in depth and all.
This is a backport of upstream commit r17801. Original commit log:
You could also fix this by just bumping the v8 in master, but that's a little more involved so I'll leave that to you if that's what you'd prefer. ;-)