CVE-2024-33259

What it actually does

Triggers a segmentation violation in scanner_seek at jerry-core/parser/js/js-scanner-util.c during JavaScript parsing, resulting in process crash due to invalid memory access.

Why it matters to the business

Applications relying on JerryScript may experience unexpected crashes when processing untrusted or malformed JavaScript, leading to service disruption without data loss or remote code execution.

How an attack unfolds

An attacker crafts JavaScript input that reaches an invalid state in the scanner, causing the segmentation violation when the parser attempts to seek within the token stream.

How to fix it

Upgrade JerryScript to a patched version that resolves the scanner_seek memory access issue in js-scanner-util.c.

How to confirm the fix worked

Reproduce the crash with known triggering JavaScript inputs against the scanner component and confirm absence of segmentation faults after applying updates.

Typical attack path

1. Identify an application using the vulnerable JerryScript commit
2. Supply crafted JavaScript that exercises the scanner_seek path
3. Trigger the segmentation violation leading to denial of service

How to detect it

Review application logs and crash dumps for segmentation faults originating from jerry-core/parser/js/js-scanner-util.c or the scanner_seek function when parsing JavaScript.

What your security team should do

• Assess all deployments using JerryScript for exposure to the parser component
• Apply available upstream fixes to the scanner module
• Consider sandboxing or input sanitization for JavaScript parsing until patched