CVE-2019-0923: Out-of-bounds write
7.5
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.88005%
CWE
Published
3/29/2021
Updated
2/1/2023
KEV Status
No
Technology
C#
C#Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.11.9 | 1.11.9 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper scope index management in coroutine/generator functions. The patches in ByteCodeGenerator.cpp added 'IsCoroutine()' checks to prevent premature release of inner scope indices in EndVisitBlock and EndVisitCatch. Without these checks, reused scope indices could lead to out-of-bounds writes when handling object memory layouts. The direct correlation between the CWE-787 pattern and the scope management logic in these functions indicates high confidence.