CVE-2023-24833 (C++, published 2023-05-18T22:15Z)
Description: value: A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/facebook/hermes
Files changed:
lib/Support/BigIntSupport.cpp
lib/VM/JSLib/Array.cpp
lib/VM/Operations.cpp
test/hermes/regress-bigint-add-gc.js
test/hermes/regress-bigint-to-double-nan.js
test/hermes/regress-invalidated-descriptor-std-sort-model-swap.js
Commit message: Re-sync with internal repository (#908)

Fixes for CVE-2023-23556, and CVE-2023-24833.

Co-authored-by: Facebook Community Bot <6422482+facebook-github-bot@users.noreply.github.com>

Vulnerable code:
  return tmp.roundToDouble(kSigned);
    ComputedPropertyDescriptor bDesc;
    JSObject::getComputedPrimitiveDescriptor(
        obj_, runtime_, bHandle_, bDescObjHandle_, bTmpNameStorage_, bDesc);

      runtime.makeHandle(resX->getBigInt()),
      runtime.makeHandle(resY->getBigInt()));

Fixed code:
  double val = tmp.roundToDouble(kSigned);
  // TODO(T142034196): APInt::roundToDouble doesn't implement proper conversion
  // when the number has more than 2 digits; we need to implement this
  // conversion.
  return std::isnan(val) ? std::numeric_limits<double>::quiet_NaN() : val;

    ComputedPropertyDescriptor bDesc;
    JSObject::getComputedPrimitiveDescriptor(
        obj_, runtime_, bHandle_, bDescObjHandle_, bTmpNameStorage_, bDesc);

      runtime.makeHandle(xPrim->getBigInt()),
      runtime.makeHandle(yPrim->getBigInt()));
/**
 * Copyright (c) Meta Platforms, Inc. and affiliates.
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE file in the root directory of this source tree.
 */

// RUN: %hermes -non-strict -O %s | %FileCheck %s
// RUN: %hermes -non-strict -O0 %s | %FileCheck %s

const obj = {
    toString: () => {
        gc();
        return 0n;
    }
};
// trigger after obj.toString called and before addOp complete
let trigger_point = 1n + obj;
print(trigger_point);

// CHECK: 1
/**
 * Copyright (c) Meta Platforms, Inc. and affiliates.
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE file in the root directory of this source tree.
 */

// RUN: %hermes -non-strict -O %s | %FileCheck %s
// RUN: %hermes -non-strict -O0 %s | %FileCheck %s

// TODO: fix BigInt to number conversion (it should never result in NaN).
print(Number(0xffffffffffffffffffffffffffffffffn));
// CHECK: NaN
/**
 * Copyright (c) Meta Platforms, Inc. and affiliates.
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE file in the root directory of this source tree.
 */

// RUN: %hermes -O %s

var a = [0,1]
a.sort(function(x,y){
  a.__defineGetter__(1, function(){
    delete a[0];
    return 1;
  });
  a.__defineGetter__(0, function(){
    return 1;
  });
  return -1;
})