CVE-2018-0943

Vulnerability

A remote code execution vulnerability exists in the way the Chakra scripting engine handles objects in memory in Microsoft Edge and ChakraCore. This is a memory corruption issue that occurs when the engine improperly processes objects in memory, leading to exploitable conditions. The vulnerability affects all versions of Microsoft Edge that use the Chakra engine and ChakraCore versions prior to the security update released on May 8, 2018. [1][2][3]

Exploitation

An attacker can exploit this vulnerability by hosting a specially crafted website that, when visited by a target user running a vulnerable version of Microsoft Edge or ChakraCore, triggers the memory corruption in the Chakra scripting engine. The attacker would need to convince the user to visit the malicious site, typically through social engineering or by injecting the content into a compromised legitimate site. No additional authentication or privileges are required beyond normal browsing. The user interaction is limited to visiting the page. [2][3]

Impact

Successful exploitation results in remote code execution in the context of the current user. An attacker who successfully exploits this vulnerability can gain the same user rights as the current user, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. If the current user has administrative privileges, the attacker could take complete control of the affected system. [1][2]

Mitigation

Microsoft released a security update on May 8, 2018 to address this vulnerability in Microsoft Edge. The update is part of the monthly Patch Tuesday release and was made available through Windows Update, Windows Server Update Services, and the Microsoft Update Catalog. Users should apply the latest updates for their Windows and Edge installations. For ChakraCore, users should update to version 1.11.1 or later. Microsoft also indicates that no workaround exists beyond applying the vendor-provided fix. [1][3][4]