7 ms·

> The fundamental bug here is really slick. The static analyzer in the JIT incorrectly believes Math.expm1(x) can't return -0. I can't get past this part. Wh

> The fundamental bug here is really slick. The static analyzer in the JIT incorrectly believes Math.expm1(x) can't return -0. I can't get past this part. When a Googler "believes" Union(PlainNumber, NaN) represents the set of possible return values for a math function and commits that in the code, how is there not an automated set of tests that use one out of every other IEEE754-associated type as input to then check whether it generates output which falls outside the assumed set of types? I mean in this case you've even got NegativeZero as its own type. What's even the point of having a type with a single value if you don't hurl it at every manually-entered optimization that it could conceivably invalidate?

tptacek 8y ago
I don't know, to me, this sounds like one of the more subtle examples of the kinds of mistakes that lead to security failures. Like, it might be an almost archetypical example of the "all bugs are security vulnerabilities" hypothesis. They got code execution from expm1! But if you believe that this is an example of wanton abuse at Google, you can trade on that belief, and in a sense put your money where your mouth is, because this is a whole class of potential bugs, not just one bug; the same pattern will recur for other places where the v8 typer is wrong about the possible results of functions. Go do a sweep! If you find one, the value of the resulting bug might be pretty decent.
- diamondo25 8y ago
  If they just didnt discard the OutOfBounds check, the V8 JS engine would be a lot safer...
  - userbinator 8y ago
    ...and probably a lot slower. Google loves to make claims about V8's performance, but not so much about security.
    - tokyodude 8y ago
      certainly V8 tries to be correct and this bug will be fixed. Chromium's position is "security in depth". They know it's impossible to have zero bugs therefore the entire architure assumes there will be bugs and tries to prevent them from causing any harm. This is also why there are roughly 10x less code execution bugs in chrome vs other browsers. same number of bugs overall but most lead nowhere
      - blattimwind 8y ago
        > Chromium's position is "security in depth". Yet the exploit in WebSQL a few weeks ago gave RCE from a component directly reachable by page scripts.
        tom_ 8y ago
        That must have been one of the bugs that lead somewhere.
        librarian42 8y ago
        Technically that was an SQL injection attack. :)
- laurentl 8y ago
  > it might be an almost archetypical example of the "all bugs are security vulnerabilities" hypothesis This article will be my new go-to example when someone handwaves a bug away with a complacent “it’ll never happen” and “it’s not that big of a deal”. Yes it will, and yes it is.
  - wglb 8y ago
    Right, and it is right up there with https://www.blackhat.com/us-18/briefings/schedule/index.html https://www.blackhat.com/us-18/briefings/schedule/index.html, whose security value was unappreciated by some very smart folks.
    - EE84M3i 8y ago
      Were you trying to link to a specific briefing? Your link just goes to the full schedule for me.
      - wglb 8y ago
        Yes, sorry about that https://www.blackhat.com/us-18/briefings/schedule/index.html#squeezing-a-key-through-a-carry-bit-11773 https://www.blackhat.com/us-18/briefings/schedule/index.html...
dnautics 8y ago
serious question - does the V8 team do property checking?
pcwalton 8y ago
I wouldn't be surprised if NegativeZero got introduced to fix some other bug along the same lines involving a different function, and when fixing that bug they neglected to notice that it applies to expm1 as well. Math.expm1 is... a bit obscure. I could certainly see myself making the same mistake.
deleted 8y ago
[deleted]
pdpi 8y ago
> how is there not an automated set of tests that use one out of every other IEEE754-associated type as input to then check whether it generates output which falls outside the assumed set of types? It's slightly worse than that. Math.expm1(-0) = -0 is explicitly called out as part of the standard[1]. You don't need to throw every IEEE754 at your functions to make sure they're all correct, but validating the explicitly defined corner cases is table stakes. 1. https://www.ecma-international.org/ecma-262/6.0/#sec-math.expm1 https://www.ecma-international.org/ecma-262/6.0/#sec-math.ex...

tptacek 8y ago

I don't know, to me, this sounds like one of the more subtle examples of the kinds of mistakes that lead to security failures. Like, it might be an almost archetypical example of the "all bugs are security vulnerabilities" hypothesis. They got code execution from expm1! But if you believe that this is an example of wanton abuse at Google, you can trade on that belief, and in a sense put your money where your mouth is, because this is a whole class of potential bugs, not just one bug; the same pattern will recur for other places where the v8 typer is wrong about the possible results of functions. Go do a sweep! If you find one, the value of the resulting bug might be pretty decent.

diamondo25 8y ago
If they just didnt discard the OutOfBounds check, the V8 JS engine would be a lot safer...
- userbinator 8y ago
  ...and probably a lot slower. Google loves to make claims about V8's performance, but not so much about security.
  - tokyodude 8y ago
    certainly V8 tries to be correct and this bug will be fixed. Chromium's position is "security in depth". They know it's impossible to have zero bugs therefore the entire architure assumes there will be bugs and tries to prevent them from causing any harm. This is also why there are roughly 10x less code execution bugs in chrome vs other browsers. same number of bugs overall but most lead nowhere
    - blattimwind 8y ago
      > Chromium's position is "security in depth". Yet the exploit in WebSQL a few weeks ago gave RCE from a component directly reachable by page scripts.
      - tom_ 8y ago
        That must have been one of the bugs that lead somewhere.
      - librarian42 8y ago
        Technically that was an SQL injection attack. :)
laurentl 8y ago
> it might be an almost archetypical example of the "all bugs are security vulnerabilities" hypothesis This article will be my new go-to example when someone handwaves a bug away with a complacent “it’ll never happen” and “it’s not that big of a deal”. Yes it will, and yes it is.
- wglb 8y ago
  Right, and it is right up there with https://www.blackhat.com/us-18/briefings/schedule/index.html https://www.blackhat.com/us-18/briefings/schedule/index.html, whose security value was unappreciated by some very smart folks.
  - EE84M3i 8y ago
    Were you trying to link to a specific briefing? Your link just goes to the full schedule for me.
    - wglb 8y ago
      Yes, sorry about that https://www.blackhat.com/us-18/briefings/schedule/index.html#squeezing-a-key-through-a-carry-bit-11773 https://www.blackhat.com/us-18/briefings/schedule/index.html...

dnautics 8y ago

serious question - does the V8 team do property checking?

pcwalton 8y ago

I wouldn't be surprised if NegativeZero got introduced to fix some other bug along the same lines involving a different function, and when fixing that bug they neglected to notice that it applies to expm1 as well. Math.expm1 is... a bit obscure. I could certainly see myself making the same mistake.

deleted 8y ago

[deleted]

pdpi 8y ago

> how is there not an automated set of tests that use one out of every other IEEE754-associated type as input to then check whether it generates output which falls outside the assumed set of types? It's slightly worse than that. Math.expm1(-0) = -0 is explicitly called out as part of the standard[1]. You don't need to throw every IEEE754 at your functions to make sure they're all correct, but validating the explicitly defined corner cases is table stakes. 1. https://www.ecma-international.org/ecma-262/6.0/#sec-math.expm1 https://www.ecma-international.org/ecma-262/6.0/#sec-math.ex...