Miggo Logo

CVE-2019-0912: Out-of-bounds write

7.5

CVSS Score
3.0

Basic Information

EPSS Score
0.88665%
Published
3/29/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
Microsoft.ChakraCorenuget< 1.11.91.11.9

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key issues: 1) In GlobOptFields.cpp, the ProcessFieldKills function was missing conditional checks for inlined functions with arguments, leading to improper field invalidation during array operations. 2) In Lower.cpp, the NewScObjectNoCtor handling lacked proper bailout checks and helper call logic, creating unsafe object initialization paths. Both were directly addressed in the security patches (936a5af/d797e3f) through added argument presence checks and bailout validation, correlating with the CWE-787 description of out-of-bounds writes via memory handling errors.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* r*mot* *o** *x**ution vuln*r**ility *xists in t** w*y t**t t** ***kr* s*riptin* *n*in* **n*l*s o*j**ts in m*mory in Mi*roso*t ****, *k* '***kr* S*riptin* *n*in* M*mory *orruption Vuln*r**ility'. T*is *V* I* is uniqu* *rom *V*-****-****, *V*-****-**

Reasoning

T** vuln*r**ility st*ms *rom two k*y issu*s: *) In `*lo*Opt*i*l*s.*pp`, t** `Pro**ss*i*l*Kills` *un*tion w*s missin* *on*ition*l ****ks *or inlin** *un*tions wit* *r*um*nts, l***in* to improp*r *i*l* inv*li**tion *urin* *rr*y op*r*tions. *) In `Low*r