CVE-2024-33255

What it actually does

Assertion failure in ECMA_STRING_IS_REF_EQUALS_TO_ONE during ecma_free_string_list causes the JerryScript engine to terminate unexpectedly when processing certain string reference operations.

Why it matters to the business

Applications relying on JerryScript for embedded scripting may experience sudden crashes and service interruptions when handling untrusted or malformed JavaScript inputs, leading to operational downtime.

How an attack unfolds

An attacker crafts JavaScript code that manipulates string references to violate internal invariants, triggering the assertion failure in the engine's string cleanup routine and forcing a crash without requiring authentication or elevated privileges.

How to fix it

Update JerryScript to a version that resolves the assertion failure in string reference handling; until a fix is available, restrict processing of untrusted scripts and implement input validation or sandboxing around the engine.

How to confirm the fix worked

Test the engine with previously crashing string manipulation test cases to confirm absence of the assertion failure; monitor process stability under load with varied JavaScript inputs.

Typical attack path

1. Supply crafted JavaScript input to the target application using JerryScript
2. Trigger string allocation and reference counting operations
3. Force execution path through ecma_free_string_list
4. Violate the ECMA_STRING_IS_REF_EQUALS_TO_ONE assertion
5. Cause process termination and denial of service

How to detect it

Review application and system logs for abrupt JerryScript process terminations or assertion-related error messages during script execution; correlate crashes with incoming JavaScript payloads.

What your security team should do

• Prioritize patching JerryScript in all embedded and IoT deployments
• Implement runtime monitoring for unexpected engine crashes
• Reduce exposure by sandboxing script execution environments