CVE-2023-23556 (C++, published 2023-05-18T22:15Z)
Description: value: An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/facebook/hermes
Files changed:
lib/Support/BigIntSupport.cpp
lib/VM/JSLib/Array.cpp
lib/VM/Operations.cpp
test/hermes/regress-bigint-add-gc.js
test/hermes/regress-bigint-to-double-nan.js
test/hermes/regress-invalidated-descriptor-std-sort-model-swap.js
Commit message: Re-sync with internal repository (#908)

Fixes for CVE-2023-23556, and CVE-2023-24833.

Co-authored-by: Facebook Community Bot <6422482+facebook-github-bot@users.noreply.github.com>

Vulnerable code:
  return tmp.roundToDouble(kSigned);
    ComputedPropertyDescriptor bDesc;
    JSObject::getComputedPrimitiveDescriptor(
        obj_, runtime_, bHandle_, bDescObjHandle_, bTmpNameStorage_, bDesc);

      runtime.makeHandle(resX->getBigInt()),
      runtime.makeHandle(resY->getBigInt()));

Fixed code:
  double val = tmp.roundToDouble(kSigned);
  // TODO(T142034196): APInt::roundToDouble doesn't implement proper conversion
  // when the number has more than 2 digits; we need to implement this
  // conversion.
  return std::isnan(val) ? std::numeric_limits<double>::quiet_NaN() : val;

    ComputedPropertyDescriptor bDesc;
    JSObject::getComputedPrimitiveDescriptor(
        obj_, runtime_, bHandle_, bDescObjHandle_, bTmpNameStorage_, bDesc);

      runtime.makeHandle(xPrim->getBigInt()),
      runtime.makeHandle(yPrim->getBigInt()));
/**
 * Copyright (c) Meta Platforms, Inc. and affiliates.
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE file in the root directory of this source tree.
 */

// RUN: %hermes -non-strict -O %s | %FileCheck %s
// RUN: %hermes -non-strict -O0 %s | %FileCheck %s

const obj = {
    toString: () => {
        gc();
        return 0n;
    }
};
// trigger after obj.toString called and before addOp complete
let trigger_point = 1n + obj;
print(trigger_point);

// CHECK: 1
/**
 * Copyright (c) Meta Platforms, Inc. and affiliates.
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE file in the root directory of this source tree.
 */

// RUN: %hermes -non-strict -O %s | %FileCheck %s
// RUN: %hermes -non-strict -O0 %s | %FileCheck %s

// TODO: fix BigInt to number conversion (it should never result in NaN).
print(Number(0xffffffffffffffffffffffffffffffffn));
// CHECK: NaN
/**
 * Copyright (c) Meta Platforms, Inc. and affiliates.
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE file in the root directory of this source tree.
 */

// RUN: %hermes -O %s

var a = [0,1]
a.sort(function(x,y){
  a.__defineGetter__(1, function(){
    delete a[0];
    return 1;
  });
  a.__defineGetter__(0, function(){
    return 1;
  });
  return -1;
})