CVE-2024-43357

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-43357
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43357.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-43357
Related
Published
2024-08-15T18:36:49Z
Modified
2025-10-21T19:33:39Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
Summary
JavaScript specification issue may lead to type confusion and pointer dereference in implementations
Details

ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type confusion and pointer dereference.

The internal async generator machinery calls regular promise resolver functions on IteratorResult ({ done, value }) objects that it creates, assuming that the IteratorResult objects will not be then-ables. Unfortunately, these IteratorResult objects inherit from Object.prototype, so these IteratorResult objects can be made then-able, triggering arbitrary behaviour, including re-entering the async generator machinery in a way that violates some internal invariants.

The ECMAScript specification is a living standard and the issue has been addressed at the time of this advisory's public disclosure. JavaScript engine implementors should refer to the latest specification and update their implementations to comply with the AsyncGenerator section.

References

  • https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727
  • https://bugzilla.mozilla.org/show_bug.cgi?id=1901411
  • https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq
  • https://bugs.webkit.org/show_bug.cgi?id=275407
  • https://issues.chromium.org/issues/346692561
  • https://www.cve.org/CVERecord?id=CVE-2024-7652
Database specific 
{
    "cwe_ids": [
        "CWE-248",
        "CWE-476",
        "CWE-843"
    ]
}
References

Affected packages

Git / github.com/tc39/ecma262

Affected ranges

Type
GIT
Repo
https://github.com/tc39/ecma262
Events
Introduced
d711ba960cd12b7658d6bb26d7556e690290190c
Fixed
84b38ad852ff426795fa29cebc06949027336c64