Two birds with one stone: An introduction to V8 And Jit Exploitation

[Gandalf_The_Grey]

Content source

https://www.zerodayinitiative.com/blog/2021/12/6/two-birds-with-one-stone-an-introduction-to-v8-and-jit-exploitation

In this special blog series, ZDI Vulnerability Researcher Hossein Lotfi looks at the exploitation of V8 – Google’s open-source high-performance JavaScript and WebAssembly engine – through the lens of a bug used during Pwn2Own Vancouver 2021. The contest submission from Bruno Keith and Niklas Baumstark exploited both Google Chrome and Microsoft Edge (Chromium) with the same bug, which earned them $100,000 during the event. This bug was subsequently found in the wild prior to being patched by Google. This blog series provides an introduction to V8, a look at the root cause of the bug, and details on exploitation during the contest and beyond.

At our Pwn2Own Vancouver contest this year, the web browser category included the Google Chrome and Microsoft Edge (Chromium) browsers as targets. For this year’s event, a successful demonstration no longer required a sandbox escape. There was also a special bonus for exploits that worked against both Chrome and Edge. On Day Two of the event, Bruno Keith and Niklas Baumstark successfully demonstrated their V8 JIT vulnerability on both the Chrome and Microsoft Edge renderers with a single exploit. This earned them $100,000 USD and 10 Master of Pwn points.

In this blog series, we’ll be covering this exploit in three separate entries:

1 - Two Birds with One Stone: An Introduction to V8 and JIT Exploitation

2 - Understanding the Root Cause of CVE-2021-21220 – A Chrome Bug from Pwn2Own 2021

3 - Exploitation of CVE-2021-21220 – From Pwn2Own to Active Exploit

We’ll begin with the basics of V8 and JIT exploitation.

Conclusion of Part One

In this blog, we set up the V8 environment and played a bit with some of its features. In the next blog, we will analyze the vulnerability used at Pwn2Own. Expect to see that blog in just two days from now.

Until then, you can find me on Twitter at @hosselot and follow the team for the latest in exploit techniques and security patches.

 

[Gandalf_The_Grey]

Understanding the Root Cause of CVE-2021-21220 – A Chrome Bug from Pwn2Own 2021

In this second blog in the series, ZDI Vulnerability Researcher Hossein Lotfi looks at the root cause of CVE-2021-21220. This bug was used during Pwn2Own Vancouver 2021 to exploit both Chrome and Edge (Chromium) to earn $100,000 at the event. Today’s blog starts with a look at how to trigger the vulnerability and goes on to describe why the bug occurs.

Conclusion

In this blog post we identified the root cause of the vulnerability used at Pwn2Own and saw how the contestants chained a series of clever values and operations to trigger an incorrect behavior in the JIT engine. In the final blog in this series, we will explore how this issue was exploited. That blog will be published one week from today.

Until then, you can find me on Twitter at @hosselot and follow the team for the latest in exploit techniques and security patches.

Zero Day Initiative — Understanding the Root Cause of CVE-2021-21220 – A Chrome Bug from Pwn2Own 2021

In this second blog in the series, ZDI Vulnerability Researcher Hossein Lotfi looks at the root cause of CVE-2021-21220. This bug was used by Bruno Keith ( @bkth_ ) and Niklas Baumstark ( @_niklasb ) of Dataflow Security ( @dfsec_com ) during Pwn2Own Vancouver 2021 to exploit both Ch

www.zerodayinitiative.com

 

[Gandalf_The_Grey]

Exploitation of Cve-2021-21220 – From incorrect Jit behavior to RCE:

n this third and final blog in the series, ZDI Vulnerability Researcher Hossein Lotfi looks at the method of exploiting CVE-2021-21220 for code execution. This bug was used by Bruno Keith (@bkth_) and Niklas Baumstark (@_niklasb) of Dataflow Security (@dfsec_com) during Pwn2Own Vancouver 2021 to exploit both Chrome and Edge (Chromium) to earn $100,000 at the event. Today’s blog looks at the exploitation technique used at the contest.

Conclusion
JIT vulnerabilities tend to be powerful, providing strong primitives and reliable exploitation methods. The inherent complexity of JIT compilation makes it very challenging for engine developers to correctly handle all corner cases, despite their impressive efforts. However, incorrect JIT behavior can impact security only if a technique is available to achieve an effect such as out-of-bounds memory access. This is one area where engine developers can focus by introducing additional hardening.

Zero Day Initiative — Exploitation of CVE-2021-21220 – From Incorrect JIT Behavior to RCE

In this third and final blog in the series, ZDI Vulnerability Researcher Hossein Lotfi looks at the method of exploiting CVE-2021-21220 for code execution. This bug was used by Bruno Keith ( @bkth_ ) and Niklas Baumstark ( @_niklasb ) of Dataflow Security ( @dfsec_com ) during Pwn2Own Va

www.zerodayinitiative.com

 

[ForgottenSeer 92963]

Thanks Gandalf,

Question to other MT-members enabling enhanced security in Edge: anyone noticed website breakage in balanced mode (disabling JIT on websites you do not visit often)?

I have not (until now). I hope the uber cage/V8 heap sandbox finds its way soon to stable.

 

[Gandalf_The_Grey]

Thanks Gandalf,

Question to other MT-members enabling enhanced security in Edge: anyone noticed website breakage in balanced mode (disabling JIT on websites you do not visit often)?

View attachment 262860
I have not (until now). I hope the uber cage/V8 heap sandbox finds its way soon to stable.

I have it set to strict and didn't notice any website breakage

 

[Andy Ful]

...
Question to other MT-members enabling enhanced security in Edge: anyone noticed website breakage in balanced mode (disabling JIT on websites you do not visit often)?
...

Strict setting on my family computers = no problem (so far).