René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CVE-2024-4761 漏洞分析与过程记录","articleBody":"author: [@relooadin / X](https://x.com/relooadin)\r\n2024-06-03 17:09:52\r\n**Shout out to [@buptsb](https://x.com/buptsb) and [@mistymntncop](https://x.com/mistymntncop) for their brilliant work.**\r\n\r\n# 漏洞信息\r\n[Chrome Releases: Stable Channel Update for Desktop (googleblog.com)](https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html)\r\nCVE-2024-4761是V8越界写入漏洞，攻击者可以通过构造恶意代码达成渲染进程RCE（沙箱内）。谷歌在发布的Chrome版本 124.0.6367.207 中修复了该漏洞。\r\ncommit：`[wasm-gc] Only normalize JSObject targets in SetOrCopyDataProperties`\r\n[[wasm-gc] Only normalize JSObject targets in SetOrCopyDataProperties (5527397) · Gerrit Code Review (googlesource.com)](https://chromium-review.googlesource.com/c/v8/v8/+/5527397)\r\n\r\n根据补丁信息及X上已公开的POC (作者: @buptdsb)可知，该漏洞是由 `SetOrCopyDataProperties` 函数在转换属性存储模式过程中校验不充分造成的越界写。\r\n\r\n\r\n# 关于补丁\r\n[[wasm-gc] Only normalize JSObject targets in SetOrCopyDataProperties (5527397) · Gerrit Code Review (googlesource.com)](https://chromium-review.googlesource.com/c/v8/v8/+/5527397)\r\n* 在 `JSReceiver::SetOrCopyDataProperties` 函数中\r\n* 当descriptor长度大于1020时，将快属性转化为慢属性。\r\n* 该补丁使非`JSObject`的对象无法进入泛化逻辑\r\n* 从标题来看重点针对`wasm-gc`对象\r\n\r\n简单地说就是新引入的`WasmObject` 对象不该进入`JSReceiver::SetOrCopyDataProperties`的 Normalize 逻辑。\r\n\r\n# POC分析\r\n![image](https://github.com/user-attachments/assets/ea1f1ab1-7d12-40b3-b217-7bfcf7a15112)\r\n会在这里崩溃\r\n![image](https://github.com/user-attachments/assets/3151b0f6-6f9b-4ca9-8df1-5194075ac244)\r\n\r\ninobject 个数计算\r\n![image](https://github.com/user-attachments/assets/2e0b8c2f-3d26-415b-9f66-f8d84818e8d3)![image](https://github.com/user-attachments/assets/66ab33ba-9450-4c72-ad39-9a45d49715c4)\r\n![image](https://github.com/user-attachments/assets/b87ffb44-2aef-4b27-8b35-6d040be4506f)\r\n![image](https://github.com/user-attachments/assets/ac4163d2-6a57-4a54-83cf-6baaac6fa4b6)\r\n[src/objects/map.h - v8/v8 - Git at Google (googlesource.com)](https://chromium.googlesource.com/v8/v8/+/70bd7cf0ef618621c16ae3f5ba2db614ac8ef996/src/objects/map.h)\r\n\r\n# OOB\r\ninobject被计算为4，前4个32bit被抹零，所以会进入 `GetRootForNonJSReceiver`\r\n![image](https://github.com/user-attachments/assets/163ead22-51fa-4285-8761-bb5879a0941d)\r\n![image](https://github.com/user-attachments/assets/d5312532-5d08-4611-802c-04cee9058bc1)\r\n![image](https://github.com/user-attachments/assets/01501740-f768-438a-8283-c4b463216112)\r\n\r\n\r\n\r\n# 重入JS\r\n在这里切回js\r\n![image](https://github.com/user-attachments/assets/9cbfbb8b-57cc-4997-8540-deb1c0d5f243)\r\n![image](https://github.com/user-attachments/assets/38122101-328c-462c-85ef-7ba6b58adbae)\r\n截图来自：[CVE-2024-4761.js (github.com)](https://gist.github.com/mistymntncop/2cb449eb6aa30d35d1afd78a8b06bac2)\r\n很多与对象属性访问相关的历史漏洞（如CVE-2021-30551）都使用过“重入JS用户代码”的模式\r\n\r\n# 利用\r\n@buptsb 与 @mistymntncop 已公开利用方法：\r\n[CVE-2024-4947: v8 incorrect AccessInfo for module namespace object causes Maglev type confusion (buptsb.github.io)](https://buptsb.github.io/blog/post/CVE-2024-4947-%20v8%20incorrect%20AccessInfo%20for%20module%20namespace%20object%20causes%20Maglev%20type%20confusion.html)\r\n[CVE-2024-4761: v8 missing check of WasmObject type cast causes type confusion and OOB access (buptsb.github.io)](https://buptsb.github.io/blog/post/CVE-2024-4761-%20v8%20missing%20check%20of%20WasmObject%20type%20cast%20causes%20type%20confusion%20and%20OOB%20access.html)\r\n\r\n被清空0~0x10的wasm_array会被识别成字符串\r\n![image](https://github.com/user-attachments/assets/2dacd52d-e59e-436b-886c-5b8a7a03f2c3)\r\n\r\ngc会把 0xf2000 00000000 当做map\r\nAs the `instance_type` is 0 for now, it’s `INTERNALIZED_TWO_BYTE_STRING_TYPE`,\r\nso we will call `CALL_APPLY(SeqTwoByteString)` to gc this object.\r\n![image](https://github.com/user-attachments/assets/2e4c4d2a-a639-497b-b615-4939033eb7ce)\r\n![image](https://github.com/user-attachments/assets/cc7af5b7-c7b9-4c63-a3f9-e8aef0b0b14b)\r\n\r\n\r\n越界写，把o.property's map覆盖为0\r\n![image](https://github.com/user-attachments/assets/f386167e-66e3-492c-a87e-2f752f8e8067)\r\n\r\n随后GC，使 `o' property` 与 `arr1` 重叠，通过访问o的属性更改 `arr1` 的 `length`。\r\n\r\n![image](https://github.com/user-attachments/assets/6c881ef1-ff97-45aa-be2f-d0ccad8354da)\r\n![image](https://github.com/user-attachments/assets/f9b0256a-629a-44f1-902b-59184d5ed2c5)\r\n![image](https://github.com/user-attachments/assets/2173bbe4-6ca3-430c-91c8-b685f0022573)\r\n\r\n# SeqTwoByteString \r\n双字节字符\r\n V8 的源代码中，有一个[方便查阅的列表](https://link.juejin.cn/?target=https%3A%2F%2Fgithub.com%2Fv8%2Fv8%2Fblob%2F941b945b%2Fsrc%2Fobjects%2Fobjects.h%23L134-L151 \"https://github.com/v8/v8/blob/941b945b/src/objects/objects.h#L134-L151\")，列出了它使用的所有字符串实现：\r\n 从 string.tq 一直往在追，SeqTwoByteString 的内存表示为：\r\n`map: Map | raw_hash_field: NameHash | length: int32 | chars[length]: char16`\r\n的形式\r\n\r\n**map为0的对象会被识别成 SeqTwoByteString**， 由于instance_type为0，即`*(base+8) = 0 `\r\n![image](https://github.com/user-attachments/assets/469cb6f1-ce35-4416-82a4-a8c2c5d6e727)\r\n\r\n原因如下：[CVE-2024-4947: v8 incorrect AccessInfo for module namespace object causes Maglev type confusion (buptsb.github.io)](https://buptsb.github.io/blog/post/CVE-2024-4947-%20v8%20incorrect%20AccessInfo%20for%20module%20namespace%20object%20causes%20Maglev%20type%20confusion.html)\r\n![image](https://github.com/user-attachments/assets/59b2bb4d-4604-4283-b771-1f01e701f7a7)\r\n![image](https://github.com/user-attachments/assets/a2e12664-aff4-4678-8d77-02e959819032)\r\n\r\n源码参考：[string.tq - Chromium Code Search](https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/string.tq)\r\n\r\n\r\n# 总结\r\n1. wasm-gc对象在`SetOrCopyDataProperties`函数中被`normalize`时发生oob（被当做JSObject）\r\n2. 越界写的内容和范围： map_base+5 ~ map_base+4 范围内置零，对于Wasm Array，该对象后紧接着的一个32位会被越界置零。\r\n3. 利用   property array reallocates 布局内存，使一个fast property（`properties[0]=0`）紧随  Wasm Array\r\n4. 触发漏洞，**fast property 的 map被置0，利用getter重回JS用户态（避免崩溃）**\r\n5. 触发 GC ，fast property 被混淆为 `SeqTwoByteString`，可通过访问 fast property 越界写入相邻对象的内部数据。\r\n\r\n## 涉及知识点：\r\n1. fast property\r\n2. Object.assign\r\n4. normalize\r\n5. map layout\r\n7. getter / runtime call\r\n8. GC\r\n9. SeqTwoByteString\r\n\r\n其他：\r\n1. map layout 查询\r\n2. 通过 x.tq 查询对象布局\r\n3. 使用 --soft-abort 关闭 DCHECK\r\n\r\n# 完整利用\r\n需要绕过 heap sandbox\r\n具体方法可参考补丁中的回归测试文件，不赘述\r\n1.  [[wasm][sandbox] Fix sandbox escapes via i32 high word (5494364) · Gerrit Code Review (googlesource.com)](https://chromium-review.googlesource.com/c/v8/v8/+/5494364)\r\n2. [[wasm][sandbox] Add WasmTrustedInstanceData::native_module (5529236) · Gerrit Code Review (googlesource.com)](https://chromium-review.googlesource.com/c/v8/v8/+/5529236)","author":{"url":"https://github.com/hatereloading","@type":"Person","name":"hatereloading"},"datePublished":"2024-08-09T09:52:00.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/2/hatereloading.github.io/issues/2"}