Exploitation Summary
EIP tracks 2 public exploits for CVE-2019-9791. PoCs published by Google Security Research, Sp0pielar.
AI-analyzed exploit summary This exploit leverages a type confusion vulnerability in SpiderMonkey's IonMonkey JIT compiler, specifically during on-stack replacement (OSR) in constructor functions. The bug allows arbitrary property manipulation and type inference bypass, leading to potential RCE.
Description
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
Exploits (2)
This exploit leverages a type confusion vulnerability in SpiderMonkey's IonMonkey JIT compiler, specifically during on-stack replacement (OSR) in constructor functions. The bug allows arbitrary property manipulation and type inference bypass, leading to potential RCE.
This exploit chain combines CVE-2019-9791 and CVE-2019-11708 to achieve arbitrary code execution in Firefox 65.0 on Windows 64-bit. It leverages type confusion to obtain read/write primitives in the content process and escalates to the main process.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H