In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601"
],
"types": [
"RCE"
],
"severity": "High",
"vanir_signatures": [
{
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57391396245715547890830208723708860505",
"21750253657437324015743194317507360124",
"330157419446234327203089572569318664082",
"260429297300354065194440523489074856769"
]
},
"id": "ASB-A-160610106-46859bfb",
"deprecated": false,
"target": {
"file": "src/messages.h"
}
},
{
"signature_version": "v1",
"id": "ASB-A-160610106-54b6314f",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250222072464983921397125065740222955587",
"110252132451295945797678870893845360847",
"292640300499617249563180930621178332870",
"111752729125479932980572755793580901975"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "src/parsing/parser-base.h"
}
},
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"function_hash": "274810250479557669623765193847622703510",
"length": 848.0
},
"id": "ASB-A-160610106-e50897b7",
"deprecated": false,
"target": {
"file": "src/parsing/parser-base.h",
"function": "ParseFormalParameterList"
}
}
],
"spl": "2021-03-01"
}
{
"fixes": [
"https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601"
],
"types": [
"RCE"
],
"severity": "High",
"vanir_signatures": [
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"function_hash": "274810250479557669623765193847622703510",
"length": 848.0
},
"id": "ASB-A-160610106-1b7d1239",
"deprecated": false,
"target": {
"file": "src/parsing/parser-base.h",
"function": "ParseFormalParameterList"
}
},
{
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57391396245715547890830208723708860505",
"21750253657437324015743194317507360124",
"330157419446234327203089572569318664082",
"260429297300354065194440523489074856769"
]
},
"id": "ASB-A-160610106-5c934f96",
"deprecated": false,
"target": {
"file": "src/messages.h"
}
},
{
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250222072464983921397125065740222955587",
"110252132451295945797678870893845360847",
"292640300499617249563180930621178332870",
"111752729125479932980572755793580901975"
]
},
"id": "ASB-A-160610106-accc41e4",
"deprecated": false,
"target": {
"file": "src/parsing/parser-base.h"
}
}
],
"spl": "2021-03-01"
}
{
"fixes": [
"https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601"
],
"types": [
"RCE"
],
"severity": "High",
"vanir_signatures": [
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"function_hash": "274810250479557669623765193847622703510",
"length": 848.0
},
"id": "ASB-A-160610106-6d2dee5e",
"deprecated": false,
"target": {
"file": "src/parsing/parser-base.h",
"function": "ParseFormalParameterList"
}
},
{
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250222072464983921397125065740222955587",
"110252132451295945797678870893845360847",
"292640300499617249563180930621178332870",
"111752729125479932980572755793580901975"
]
},
"id": "ASB-A-160610106-88c24bc1",
"deprecated": false,
"target": {
"file": "src/parsing/parser-base.h"
}
},
{
"signature_version": "v1",
"id": "ASB-A-160610106-c45d7bb6",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57391396245715547890830208723708860505",
"21750253657437324015743194317507360124",
"330157419446234327203089572569318664082",
"260429297300354065194440523489074856769"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "src/messages.h"
}
}
],
"spl": "2021-03-01"
}
{
"fixes": [
"https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601"
],
"types": [
"RCE"
],
"severity": "High",
"vanir_signatures": [
{
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"function_hash": "274810250479557669623765193847622703510",
"length": 848.0
},
"id": "ASB-A-160610106-1c1a13ed",
"deprecated": false,
"target": {
"file": "src/parsing/parser-base.h",
"function": "ParseFormalParameterList"
}
},
{
"signature_version": "v1",
"id": "ASB-A-160610106-52b55af7",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250222072464983921397125065740222955587",
"110252132451295945797678870893845360847",
"292640300499617249563180930621178332870",
"111752729125479932980572755793580901975"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "src/parsing/parser-base.h"
}
},
{
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/external/v8/+/089e85f552ec92402d9fcd19d110b0c7521c4601",
"digest": {
"threshold": 0.9,
"line_hashes": [
"57391396245715547890830208723708860505",
"21750253657437324015743194317507360124",
"330157419446234327203089572569318664082",
"260429297300354065194440523489074856769"
]
},
"id": "ASB-A-160610106-afd1cecb",
"deprecated": false,
"target": {
"file": "src/messages.h"
}
}
],
"spl": "2021-03-01"
}