isolated-vm flaw enables remote code execution on host

A type-confusion bug in the isolated-vm Node.js library’s ExternalCopy routine can let an attacker trigger native code to dereference an attacker-controlled pointer, causing a crash or enabling control-flow hijack and potential remote code execution on the host. The flaw involves a time-of-check/time-of-use (TOCTOU) mismatch in the transferList used to move large ArrayBuffers between V8 Isolates.

ExternalCopy serializes data in one V8 Isolate and reconstructs it in another. For performance, it accepts a transferList that lists ArrayBuffers whose backing memory is detached from the source and handed to the destination. During reconstruction the code walks the transferList twice and assumes the list does not change between passes. If an element in transferList is implemented as a JavaScript getter that returns different values on each read, the second pass can read a different value and produce a type confusion.

Although the ExternalCopy constructor is only callable from host code, a guest running inside an Isolate can use ivm.Reference-the mechanism hosts use to expose objects to a sandbox-to build a malicious transferList and provoke the flaw. The isolated-vm project warned that any embedder running untrusted code in an Isolate that shares even a single Reference into it is affected. Host code that passes a caller-influenced array as transferList is directly vulnerable even without malicious guest code.

Maintainers published fixes in isolated-vm versions 6.2.0 and 7.0.1. The updates change the copy process to prevent user JavaScript from running during the reconstruction step. At the time of the advisory no public CVE identifier had been assigned.

EndorLabs, which analyzed the defect, wrote: “The vulnerability lived in the native glue code: the C++ binding that serializes values across the boundary. That layer is written in a memory-unsafe language; it manipulates raw V8 handles and backing-store pointers, and it re-reads attacker-controlled JavaScript objects in the middle of a security-sensitive operation. A single unchecked cast on a re-read value was enough to turn a correct isolation primitive into a full escape.”

Successful exploitation can cause process termination, producing a denial-of-service, or permit control-flow hijack of the host process and execution of native code on the underlying machine.