Crash when using shared memory in JavaScript

Crash when using shared memory in JavaScript

Announced

August 11, 2015

Reporter

Jukka Jylänki

Impact

Moderate

Products

Firefox, Firefox ESR, SeaMonkey

Fixed in

• Firefox 40
• Firefox ESR 38.2
• SeaMonkey 2.35

Description

Security researcher Jukka Jylänki reported a crash that occurs because JavaScript, when using shared memory, does not properly gate access to Atomics or SharedArrayBuffer views in some contexts. This leads to a non-exploitable crash.

References

• crash in void js::jit::AssemblerX86Shared::lock_addl<js::jit::Imm32> (CVE-2015-4484)