Out-of-Bounds Read in MicroQuickJS Engine

Executive Summary

This vulnerability is an out-of-bounds read issue in MicroQuickJS (mquickjs) before commit 99eed3f. It occurs when JS_Call() raises exceptions during frame setup without updating the context's stack pointer (ctx->sp) and frame pointer (ctx->fp). Attackers can exploit this by providing JavaScript that calls a non-function value, causing build_backtrace() to traverse stale frame pointers and crash the engine, leading to a denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in mquickjs applications, particularly when processing JavaScript code that triggers exceptions during function calls. Use AddressSanitizer (ASan) or UndefinedBehaviorSanitizer (UBSan) builds of mquickjs to detect misaligned memory accesses or out-of-bounds reads in the build_backtrace function.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the JavaScript engine to crash, leading to denial of service. If exploited, it may allow attackers to disrupt applications relying on mquickjs, potentially causing service interruptions or crashes in systems using vulnerable versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service via crashes, which may indirectly impact compliance by disrupting system availability. GDPR requires data processing integrity and availability, while HIPAA mandates reliable access to protected health information. A crash could temporarily prevent access to critical data, potentially violating availability requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update mquickjs to commit 99eed3f or later to apply the fix for exception handling in JS_Call. If updating is not possible, restrict execution of untrusted JavaScript code in mquickjs environments to reduce attack surface.

Useful 0 Not Useful 0