CVE-2024-27820

Overview

Impact:

Description: Processing web content may lead to arbitrary code execution

Researchers: Jeff Johnson of underpassapp.com

Attribute	Value
CVE	CVE-2024-27820
Bugzilla	270139
Component	JSC
Bug Class	LogicError
Severity	critical
Commit	6a341af34a111bdf…
Advisory	Apple Advisory

Root Cause Analysis

The issue was addressed with improved memory handling.

Files Changed

Source Files

Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp

Patch Preview

diff --git a/Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp b/Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp
index 24352a97dc76..e46f788274a8 100644
--- a/Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp
+++ b/Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp
@@ -444,7 +444,8 @@ void InspectorDebuggerAgent::didScheduleAsyncCall(JSC::JSGlobalObject* globalObj
     if (!m_currentAsyncCallIdentifierStack.isEmpty()) {
         auto it = m_pendingAsyncCalls.find(m_currentAsyncCallIdentifierStack.last());
         ASSERT(it != m_pendingAsyncCalls.end());
-        parentStackTrace = it->value;
+        if (LIKELY(it != m_pendingAsyncCalls.end()))
+            parentStackTrace = it->value;
     }
 
     auto identifier = asyncCallIdentifier(asyncCallType, callbackId);