Integer Overflow in QuickJS-NG Leads to Heap Buffer Overflow

Executive Summary

QuickJS-NG before version 0.16.0 has an integer overflow bug in the js_typed_array_sort() function. On 32-bit systems, attackers can trigger a heap buffer overflow by sorting a TypedArray with a comparator after it reaches around 2^30 elements. The overflow corrupts the allocation size, allowing writes beyond the intended buffer, which can crash the program or potentially execute arbitrary code.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the version of QuickJS-NG installed on your system. If you are running a version before 0.16.0, your system is vulnerable. Use commands like 'quickjs --version' or check package managers (e.g., 'apt list --installed | grep quickjs' or 'npm list quickjs-ng') to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

If you run JavaScript code on a 32-bit system using QuickJS-NG before 0.16.0, an attacker who can execute JavaScript could exploit this to crash your application or run malicious code. This could lead to data loss, system compromise, or unauthorized access depending on the context of the vulnerable application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution or data breaches, which may violate GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations if exploitation leads to data exposure or system compromise.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update QuickJS-NG to version 0.16.0 or later. If updating is not possible, restrict JavaScript execution in untrusted environments or disable TypedArray.prototype.sort in JavaScript code to prevent exploitation.

Useful 0 Not Useful 0