CVE-2018-8177

Vulnerability

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge [1]. This is a memory corruption vulnerability in ChakraCore, the open source JavaScript engine used by Microsoft Edge [3]. The vulnerability specifically involves a speculative type confusion on PropertyString, as evidenced by a fix in the ChakraCore repository [4]. The affected versions include all versions of Microsoft Edge on various Windows 10 platforms, as indicated by the SecurityFocus entry for related CVE-2018-8137 [2].

Exploitation

To exploit this vulnerability, an attacker would need to host a specially crafted website and then convince a user to view it in Microsoft Edge [1]. The attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the Edge rendering engine. The memory corruption occurs when the Chakra scripting engine improperly handles objects in memory during the processing of JavaScript code [1]. The exploit requires user interaction in the form of visiting a malicious webpage or opening a crafted document [1].

Impact

Successful exploitation allows an attacker to gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights [1]. This represents a complete compromise of confidentiality, integrity, and availability (CIA).

Mitigation

Microsoft released a security update to address this vulnerability as part of the May 2018 Patch Tuesday updates [1]. Users should apply the latest updates for Microsoft Edge and Windows 10. For ChakraCore users, Microsoft provided security updates for ChakraCore 1.11 until March 9, 2021, after which it became a community-supported project [3]. The fix is implemented in commit eb4b00bcd61a56d5ac66f4155870cba3178d3273 in the ChakraCore repository [4]. No workarounds are documented other than applying the patch.