Bug 263758 (CVE-2024-23252) - Integer calculation error after JIT optimization. This may cause overflow or underflow, leading to exploitable vulnerability.
Summary: Integer calculation error after JIT optimization. This may cause overflow or ...
Status: RESOLVED DUPLICATE of bug 264278
Alias: CVE-2024-23252
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Linux
: P2 Critical
Assignee: Yijia Huang
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-10-26 19:10 PDT by anbu1024
Modified: 2024-03-19 10:34 PDT (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description anbu1024 2023-10-26 19:10:28 PDT
JSC version:
afe912ce640a337086d106e4853c3dabae003a38

Build options:
```
./Tools/Scripts/build-jsc --jsc-only --debug
```

Test case:
```
function foo(arg) {

	const x = /\s.\W/iu;
	x + x;

	const a = 0 | arg;
	const b = a + 0.1;
	
	const vvv = 1020000;
	const c = b >> x;
	
	return c;
}

let x = 3;

let y = -2147483647; // 0x7fffffff

let apple = foo(y);
print("function call before JIT opt")
print(apple);

for(let i=0; i<200; i++) {
	foo(x);
}
let banana = foo(y);
print("function call after JIT opt")
print(banana);
```

Result:
```
function call before JIT opt
-2147483646
function call after JIT opt
-2147483647
```
Comment 1 Radar WebKit Bug Importer 2023-10-26 19:10:48 PDT
<rdar://problem/117563215>
Comment 2 Yijia Huang 2023-11-02 16:37:19 PDT
Pull request: https://github.com/apple/WebKit/pull/909
Comment 3 Mark Lam 2024-03-19 09:13:36 PDT
Pull request https://github.com/apple/WebKit/pull/909 is invalidated.

This turned out to not be a security bug after all.  Due to some unfortunate paperwork shuffle, this bug actually ended up being fixed in https://bugs.webkit.org/show_bug.cgi?id=264278.
Comment 4 Mark Lam 2024-03-19 09:14:30 PDT
Sorry for the forward dupe, but https://bugs.webkit.org/show_bug.cgi?id=264278 tracks the fix.

*** This bug has been marked as a duplicate of bug 264278 ***