Chrome · V8
CVE-2025-6554
Type Confusion in V8
Overview
High
Severity
—
CVSS
Yes
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
hole_check_scope_src/interpreter/bytecode-generator.cc |
modified |
Files Changed
src/interpreter/bytecode-generator.cc
Patch
From 22e9d9621de58ec6fe6581b56215059a48451b9f Mon Sep 17 00:00:00 2001 From: Stephen Roettger <[email protected]> Date: Thu, 26 Jun 2025 10:33:16 +0200 Subject: [PATCH] [interpreter] don't elide hole checks across optional chain Bug: 427663123 Change-Id: Iefdb15828d807bf9452b88e918a4b46cc2d422fa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6678591 Commit-Queue: Stephen Röttger <[email protected]> Reviewed-by: Toon Verwaest <[email protected]> Cr-Commit-Position: refs/heads/main@{#101050} --- diff --git a/src/interpreter/bytecode-generator.cc b/src/interpreter/bytecode-generator.cc index 921a8d0..1b8966c9 100644 --- a/src/interpreter/bytecode-generator.cc +++ b/src/interpreter/bytecode-generator.cc @@ -1221,7 +1221,8 @@ public: explicit OptionalChainNullLabelScope(BytecodeGenerator* bytecode_generator) : bytecode_generator_(bytecode_generator), - labels_(bytecode_generator->zone()) { + labels_(bytecode_generator->zone()), + hole_check_scope_(bytecode_generator) { prev_ = bytecode_generator_->optional_chaining_null_labels_; bytecode_generator_->optional_chaining_null_labels_ = &labels_; } @@ -1236,6 +1237,9 @@ BytecodeGenerator* bytecode_generator_; BytecodeLabels labels_; BytecodeLabels* prev_; + // Use the same scope for the entire optional chain, as links earlier in the + // chain dominate later links, linearly. + HoleCheckElisionScope hole_check_scope_; }; // LoopScope delimits the scope of {loop}, from its header to its final jump. @@ -6483,9 +6487,6 @@ void BytecodeGenerator::BuildOptionalChain(ExpressionFunc expression_func) { BytecodeLabel done; OptionalChainNullLabelScope label_scope(this); - // Use the same scope for the entire optional chain, as links earlier in the - // chain dominate later links, linearly. - HoleCheckElisionScope elider(this); expression_func(); builder()->Jump(&done); label_scope.labels()->Bind(builder());
Loading diff…
Original Bug Report
reported by [email protected]
[0-day] delete construct leaking TheHole
NOTE: We have evidence that the following bug is being used in the wild. Therefore, this bug is subject to a 7 day disclosure deadline
VULNERABILITY DETAILS
Context shared with saelo@ and tsuro@. The following construct is leaking the_hole value which, combined with a typer bug can lead to arbitrary r/w within the v8 heap sandbox.
delete {}.R?.O[{}.a = f];
%DebugPrint(f);
let f = {};
VERSION Chrome Version: HEAD + stable Operating System: all
REPRODUCTION CASE
The attached p.js triggers a crash in PushStackTraceAndDie. Samuel and Stephen are working on a reproducer triggering a memory corruption.
CREDIT INFORMATION Reporter credit: Clement Lecigne of Google’s Threat Analysis Group
References
On This Page