QuickJS Buffer Over-Read Vulnerability in ArrayBuffer.prototype.slice Function

A heap buffer overflow vulnerability has been identified in QuickJS versions prior to commit eb2c89087def1829ed99630cb14b549d7a98408c. The issue arises in the ArrayBuffer.prototype.slice() method, particularly with resizable ArrayBuffers. This vulnerability allows for a buffer over-read, where the program reads data beyond the allocated memory, potentially leading to information disclosure. The vulnerability is classified as a Time-of-Check-Time-of-Use (TOCTOU) condition, where the buffer's size is manipulated during the slicing operation, causing an out-of-bounds read of over 400 bytes.

Impact

Exploitation of this vulnerability causes a heap-buffer-overflow, leading to a read of size 500 bytes from an address 400 bytes beyond the allocated buffer, according to AddressSanitizer logs.

Reproduction

The vulnerability can be reproduced by creating a resizable ArrayBuffer and defining a custom species constructor that resizes the buffer. When the slice method is called, the vulnerability is triggered, causing a heap-buffer-overflow.

Remediation

Users are advised to update to the latest version of QuickJS, where this vulnerability has been patched.