Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-0860

CVE-2019-0860: ChakraCore Memory Corruption Vulnerability

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-0860
GHSA ID
GHSA-fv87-p7qr-xh5x
EPSS Score
0.90276%
CWE
CWE-787
Published
5/13/2022
Updated
10/7/2023
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
Microsoft.ChakraCorenuget< 1.11.81.11.8

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key issues: 1) Improper handling of 'arguments' property symbols in optimization passes (CWE-787 via incorrect object management), and 2) Insufficient bounds checking for slot indices (CWE-787 via OOB writes). The patch adds critical FinishOptPropOp calls for 'arguments' handling and replaces debug-only assertions with release-enforced checks. The affected functions are directly modified in the security patch and correlate with the CWE's out-of-bounds write pattern through their responsibility for memory operations and optimization decisions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* r*mot* *o** *x**ution vuln*r**ility *xists in t** w*y t**t t** ***kr* s*riptin* *n*in* **n*l*s o*j**ts in m*mory in Mi*roso*t ****, *k* '***kr* S*riptin* *n*in* M*mory *orruption Vuln*r**ility'. T*is *V* I* is uniqu* *rom *V*-****-****, *V*-****-**

Reasoning

T** vuln*r**ility st*ms *rom two k*y issu*s: *) Improp*r **n*lin* o* '*r*um*nts' prop*rty sym*ols in optimiz*tion p*ss*s (*W*-*** vi* in*orr**t o*j**t m*n***m*nt), *n* *) Insu**i*i*nt *oun*s ****kin* *or slot in*i**s (*W*-*** vi* OO* writ*s). T** p*t