Garbage Collection Internals of Jscript and CVE-2018-8389

No ratings

Presented at BSidesDelhi 2018 by

Sudhakar Verma

JScript is the original Microsoft ECMAScript standard introduced in IE3. It was the primary runtime engine upto IE8. Although IE9 and up discarded JScript in favour of Chakra, it can still be loaded with a compatibility mode. JScript is used not just for JS runtime in IE but also for some other windows features including scripting and Windows Automatic Proxy Discovery(WPAD). WPAD configuration files are executed as JScript code in a SYSTEM context to resolve proxy addresses. Finding a vulnerability not only gives a good execution primitive but also privilege escalation. JScript is quite simple with no JIT and a simple Garbage Collector. Recently we have seen vulnerabilities involving heap management and garbage collection. My talk will go into details of internals of jscript.dll – Object/code management, garbage collection algorithm and heuristics. I’ll also show an old CVE with the internals.