{"id":13713,"date":"2018-10-29T14:19:04","date_gmt":"2018-10-29T22:19:04","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2018\/10\/29\/news-7480\/"},"modified":"2018-10-29T14:19:04","modified_gmt":"2018-10-29T22:19:04","slug":"news-7480","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/10\/29\/news-7480\/","title":{"rendered":"SSD Advisory \u2013 Chrome Type Confusion in JSCreateObject Operation to RCE"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Mon, 29 Oct 2018 09:21:47 +0000<\/strong><\/p>\n

\n
\n

Vulnerabilities Summary<\/strong>
The following advisory discusses a vulnerability found in turbofan, the JIT compiler. We can trigger the JavaScript code in a way that leads to type confusion that can be exploited in order to execute code remotely on Google Chrome Versions 69.0 and before.<\/p>\n

Vendor Response<\/strong>
Vendor has fixed the issue in Google Chrome version 70.<\/p>\n

CVE<\/strong>
CVE-2018-17463<\/p>\n

Credit<\/strong>
Independent security researcher, Samuel Gro\u00df, had reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.<\/p>\n

Affected systems<\/strong>
Google Chrome Versions 69.0 and before.
<\/span>
Vulnerability Details<\/strong>
In turbofan, the JIT compiler for v8, code is represented in a custom intermediate representation (IR) suitable for the various optimizations. To be able to detect and remove redundant checks, turbofan has to be able to model the side effects of all its IR operations. If this modelling is incorrect, safety checks, such as type checks, will incorrectly be removed from the emitted code, resulting in type confusions at runtime. See https:\/\/saelo.github.io\/presentations\/blackhat_us_18_attacking_client_side_jit_compilers.pdf<\/a> for more information about this type of vulnerability. Turbofan assumes that the JSCreateObject operation, used for JavaScript code such as \u201clet newObj = Object.create(proto)\u201d, is completely side-effect free, as can be seen in the definition of the operation in js-operator.cc (the kNoWrite flag essentially means that the operation is sideeffect free):<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n