PT-2017-15026 · Apple · Safari Technology Preview

Published 2017-12-21 · Updated 2018-01-10 · CVE-2017-17821

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Safari Technology Preview Release 46

Description The issue allows remote attackers to cause a denial of service or possibly have other impacts because it incorrectly handles cases where the old array length is greater than the new array length. This is due to the FastBitVectorWordOwner::resizeSlow function being called for a purpose other than initializing a bitvector size. The function is located in WTF/wtf/FastBitVector.cpp and is related to the WTF/wtf/FastBitVector.h file in WebKit.

Recommendations As a temporary workaround, consider disabling the resizeSlow function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-17821

Affected Products

Safari Technology Preview

References · 9

• 🔥 https://github.com/dwfault/PoCs/blob/master/WebKit%20Misuse%20of%20WTF:wtf:FastBitVector%20result%20in%20potential%20BOF/WebKit%20Misuse%20of%20WTF:wtf:FastBitVector%20result%20in%20potential%20BOF.md · Exploit
• https://security-tracker.debian.org/tracker/CVE-2017-17821 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17821 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17821 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17821 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-17821 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-17821 · Security Note
• https://bugs.webkit.org/show_bug.cgi?id=181020 · Note