Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2016-3265

CVE-2016-3265:
ChakraCore RCE Vulnerability

8.8

CVSS Score

Basic Information

CVE ID
CVE-2016-3265
GHSA ID
GHSA-f2pg-gcxp-gr2c
EPSS Score
-
CWE
CWE-119
Published
5/14/2022
Updated
11/2/2023
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
Microsoft.ChakraCorenuget< 1.2.0.01.2.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from four key areas: (1) The InterpreterThunkEmitter stored a critical function pointer (interpreterThunk) in heap memory, making it susceptible to corruption (CWE-119). The commit replaced this with a boolean and directly fetched the thunk address during code generation. (2) InternalCopyNativeFloatArrayElements lacked proper type checks, enabling type confusion (CWE-119). (3) DirectSetItemAt was used in array operations without validating the target array's type, allowing species constructor abuse. (4) ArrayBuffer::TransferInternal used unsafe realloc, leaving uninitialized memory exposed. The patch introduced MemCpyZero/ReallocZero to mitigate this. Test cases in Array_TypeConfusion_bugs.js confirm these scenarios.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** ***kr* J*v*S*ript *n*in* in Mi*roso*t **** *llows r*mot* *tt**k*rs to *x**ut* *r*itr*ry *o** or **us* * **ni*l o* s*rvi** (m*mory *orruption) vi* * *r**t** w** sit*, *k* "S*riptin* *n*in* M*mory *orruption Vuln*r**ility," * *i***r*nt vuln*r**ilit

Reasoning

T** vuln*r**ility st*mm** *rom *our k*y *r**s: (*) T** Int*rpr*t*rT*unk*mitt*r stor** * *riti**l *un*tion point*r (int*rpr*t*rT*unk) in ***p m*mory, m*kin* it sus**pti*l* to *orruption (*W*-***). T** *ommit r*pl**** t*is wit* * *ool**n *n* *ir**tly *