CVE-2024-29943

A Pwn2Own SpiderMonkey JIT Bug: From Integer Range Inconsistency to Bound Check Elimination then RCE.

Reproducing CVE-2024-29943 for Windows, based on https://github.com/bjrjk/CVE-2024-29943

Modifications

The original exploit is written for Linux, so I attempted to reproduce it on Windows:

• Updated the pop calc shellcode for Windows and adjusted some heap feng shui parameters. (I don't fully understand how the heap on Windows works yet, so just tweaked some numbers until it was stable.)
• Used Uint8Array instead of Array to minimize the distance needed for out-of-bounds access.
• Everything else is the same.

Files:

• Exploit_64.js - Modified version using BigUint64Array for OOB writes. (~ 20GB)
• Exploit_8.js - Modified version using Uint8Array for OOB writes to reduce RAM consumption. (~ 10GB)

Demo