CVE-2020-24345: 
NixOS vulnerability analysis and mitigation

JerryScript through 2.3.0 contains a stack consumption vulnerability (CVE-2020-24345) discovered in July 2020. The vulnerability allows attackers to cause a stack overflow via a specific function call pattern: function a(){new new Proxy(a,{})}JSON.parse("[]",a). The vendor has noted that the issue stems from the lack of a --stack-limit option (GitHub Issue).

The vulnerability exists in the ecma_is_lexical_environment function within the JerryScript codebase. When exploited, it triggers a stack overflow condition in the lexical environment handling code. The issue has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability can lead to a stack overflow condition, potentially causing denial of service or other unspecified impacts on the affected system. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of the system (NVD).

The vulnerability can be triggered through a specific JavaScript code pattern involving nested Proxy constructors and JSON parsing. A proof-of-concept exploit has been publicly documented that demonstrates the stack overflow condition (GitHub Issue).

The vendor has indicated that the issue is related to the absence of the --stack-limit option. Users should consider implementing stack limits when using JerryScript to prevent such stack overflow conditions (NVD).