CVE-2017-8636
HIGHMicrosoft Internet Explorer and Edge - Remote Code Execution via Scripting Engine Memory Corruption
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2017-8636. PoCs published by Google Security Research, Huang Anwen.
AI-analyzed exploit summary This PoC exploits an integer overflow vulnerability in the Chakra JavaScript engine (CVE-2017-8636) by passing an excessively large number of arguments to the Array constructor, bypassing a flawed overflow check. The exploit triggers a denial-of-service condition due to incorrect handling of argument counts.
Description
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
Exploits (4)
This PoC exploits an integer overflow vulnerability in the Chakra JavaScript engine (CVE-2017-8636) by passing an excessively large number of arguments to the Array constructor, bypassing a flawed overflow check. The exploit triggers a denial-of-service condition due to incorrect handling of argument counts.
This is a technical writeup detailing a null pointer dereference and stack overflow vulnerability in ChakraCore's ByteCodeEmitter.cpp. It includes code snippets and a debugger output but lacks executable exploit code.
This is a writeup detailing a heap-based overflow vulnerability in ChakraCore's InterpreterStackFrame. The analysis includes code snippets and debugger output, explaining how the vulnerability can be triggered by manipulating the `varAllocCount` to exceed the `LocalsThreshold`.
This exploit demonstrates an integer overflow vulnerability in ChakraCore (CVE-2017-8636) where constructing a new object with 0xFFFF arguments causes an out-of-bounds write. The PoC targets Microsoft Edge's JavaScript engine, leading to potential remote code execution.
References (8)
Scores
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H