Chakra Scripting Engine Memory Corruption Vulnerability

Vulnerability

CVE-2020-17131 is a memory corruption vulnerability in the ChakraCore scripting engine, identified as an out-of-bounds write [3]. The root cause lies in improper handling of certain script operations, which can lead to memory corruption when processing specially crafted content.

Exploitation

An attacker could exploit this vulnerability by hosting a specially crafted website designed to trigger the memory corruption via the scripting engine. In a web-based attack scenario, the attacker would need to convince a user to visit the malicious website, typically through a link or by redirecting the user's browser. The user would then inadvertently execute the malicious script, triggering the vulnerability.

Impact

Successful exploitation could allow an attacker to execute arbitrary code in the context of the current user. If the current user has administrative privileges, the attacker could take control of the affected system, potentially installing programs, viewing/changing/deleting data, or creating new accounts with full user rights. The vulnerability is rated with a CVSS score, indicating remote code execution risk.

Mitigation

Microsoft addressed this vulnerability in their December 2020 Security Update, which was applied to the ChakraCore codebase in a pull request [3]. Users are advised to apply the latest updates to Microsoft Edge and any software embedding ChakraCore. The fix specifically adds bounds checking to prevent the out-of-bounds write [3].