CVE-2022-22894

What it actually does

Stack-based buffer overflow triggered during hash table lookup in the ECMA lcache implementation, allowing out-of-bounds memory writes on the stack.

Why it matters to the business

Applications embedding the JavaScript engine can be crashed or made to execute attacker-supplied code when processing untrusted scripts, leading to service disruption or full host compromise in environments that rely on this engine.

How an attack unfolds

An attacker crafts a JavaScript payload that repeatedly triggers ecma_lcache_lookup with values that overflow the stack frame; because the flaw requires local access and user interaction, the payload is typically delivered via a malicious file or embedded script that the victim opens or executes.

How to fix it

Upgrade to a patched Jerryscript release that corrects the bounds handling inside ecma_lcache_lookup; if no newer release exists, apply a vendor or community patch that adds proper stack-size validation before cache operations, or sandbox the engine with strict memory limits.

How to confirm the fix worked

Confirm the installed Jerryscript version is newer than 3.0.0 and that the ecma-lcache.c source no longer contains the vulnerable lookup path; run the original proof-of-concept script under a debugger or sanitizer to verify absence of stack overflow.

Typical attack path

1. Identify or supply a Jerryscript-based application that processes attacker-controlled JavaScript.
2. Craft a script containing repeated property accesses or object operations that exercise the lcache lookup path.
3. Deliver the script locally (file, command-line argument, or embedded resource) and trigger execution.
4. Overwrite stack control data to redirect execution to attacker-controlled code or cause denial of service.

How to detect it

Search process execution logs and application telemetry for Jerryscript instances started with untrusted script arguments; inspect crash dumps or sanitizer reports for stack overflow indicators around ecma_lcache_lookup; monitor for repeated cache-miss patterns that precede abnormal termination.

What your security team should do

• Inventory all products and containers that embed Jerryscript and mark them for immediate upgrade or replacement.
• Apply runtime sandboxing or memory-limit controls to any remaining instances until patches are deployed.
• Block untrusted JavaScript execution paths in applications that cannot be updated promptly.
• Add the engine to the vulnerability scanning policy with an alert for any version <= 3.0.0.