CVE-2019-0567

Vulnerability

The vulnerability is a type confusion bug in the Chakra scripting engine, affecting both Microsoft Edge and the open-source ChakraCore [1]. It exists in the JIT-compiled code path where the NewScObjectNoCtor and InitProto opcodes are treated as having no side effects, but they can actually cause a transition to a new type via the SetIsPrototype method of the type handler. This leads to incorrect type assumptions, allowing the attacker to overwrite internal pointers, such as property slot pointers [4]. All versions prior to the January 2019 security update are affected; for ChakraCore, versions up to 1.11 are vulnerable [3][4].

Exploitation

The attacker must first convince a user to visit a specially crafted web page in Edge (or process it in an application embedding ChakraCore). The exploit requires no authentication beyond the user visiting the page. The attack involves running JavaScript that triggers the JIT compilation of a function (e.g., opt()) with a crafted prototype or constructor. By manipulating the prototype chain and object properties across multiple invocations, the attacker causes the JIT to generate code with faulty type assumptions. The provided proof-of-concept demonstrates the technique: after approximately 2000 iterations to train the JIT, a call with a controlled value (e.g., 0x1234) overwrites a property slot pointer, leading to type confusion [4].

Impact

Successful exploitation allows a remote attacker to execute arbitrary code in the context of the current user. If the user is logged on with administrative privileges, the attacker could take control of the system, install programs, view/change/delete data, or create new accounts. The vulnerability is classified as remote code execution with critical severity [1].

Mitigation

Microsoft released a security update on January 8, 2019, which addressed this vulnerability in all affected versions of Microsoft Edge and ChakraCore [1]. For ChakraCore, the open-source project announced it would continue providing security updates for version 1.11 until March 9, 2021, after which users must rely on community-maintained forks or upgrade to a supported branch [3]. There is no known workaround other than applying the fix. This CVE is not listed on the KEV catalog as of the last check.