5 ms·

Exploiting Chrome V8: Krautflare

61 points by austincheney 8y ago

css 8y ago
The left sidebar covers about a third of the content for me.
- saagarjha 8y ago
  You can click on the hamburger menu to hide it.
  - matt4077 8y ago
    Nope. Reader mode also doesn’t work, which is rather uncommon.
    - saagarjha 8y ago
      What browser are you using? On mobile Safari, I don't see the sidebar, and in Safari on macOS I can hide the sidebar. Reader mode doesn't work on either.
      - jaybosamiya 8y ago
        Reader mode should be working now. Just tested on mobile Safari.
    - theandrewbailey 8y ago
      Firefox reader mode works.
- deleted 8y ago
  [deleted]
- jaybosamiya 8y ago
  Hi! It looks like I'd forgotten to update the CSS in one portion, due to this, on medium-sized screens, there was an overlap that occurred. This should be fixed now.
saagarjha 8y ago
Really interesting bug in TurboFan's optimizer; getting Math.expm1 handling -0 incorrectly to removing bounds checks by dancing around multiple optimization passes was quite illuminating. Although, later in the exploit, it seems like using WebAssembly creates a RWX page? Why is Chrome doing this for WebAssembly when it stopped doing this for JavaScript, for obvious reasons?
- kentonv 8y ago
  V8 WebAssembly TLM Ben Titzer explained in a previous HN comment: https://news.ycombinator.com/item?id=18812449 https://news.ycombinator.com/item?id=18812449
Karlax 8y ago
Impressively, Shellphish solved this challenge in 3 hours. The CTF's interactive leaderboard is fun to play with: https://archive.aachen.ccc.de/35c3ctf.ccc.ac/ https://archive.aachen.ccc.de/35c3ctf.ccc.ac/
aboutruby 8y ago
And those Hacker News, Reddit and Twitter messages from Cloudflare employees about their VM-less workers's security will be gold in the future.
kentonv 8y ago
Andrea Biondo did a writeup of the same CTF which I liked a lot. https://abiondo.me/2019/01/02/exploiting-math-expm1-v8/ https://abiondo.me/2019/01/02/exploiting-math-expm1-v8/ EDIT: Previous HN discussion on Andrea's writeup: https://news.ycombinator.com/item?id=18808488 https://news.ycombinator.com/item?id=18808488
jtwaleson 8y ago
Wow, I feel very dumb after reading this.
- fwip 8y ago
  It shouldn't make you feel dumb - it should just make you aware of the incredible breadth and depth of human knowledge out there. For every single field, there is so much to learn and know. People often underestimate how complex their sister-fields are. You know enough to be dangerous, but not enough to know how much you don't know.
jaybosamiya 8y ago
Hi! Author here. Happy to answer any questions.
brokenmachine 8y ago
Can anyone explain the bug and how it was exploited in simpler terms?

61 points by austincheney 8y ago

css 8y ago

The left sidebar covers about a third of the content for me.

saagarjha 8y ago
You can click on the hamburger menu to hide it.
- matt4077 8y ago
  Nope. Reader mode also doesn’t work, which is rather uncommon.
  - saagarjha 8y ago
    What browser are you using? On mobile Safari, I don't see the sidebar, and in Safari on macOS I can hide the sidebar. Reader mode doesn't work on either.
    - jaybosamiya 8y ago
      Reader mode should be working now. Just tested on mobile Safari.
  - theandrewbailey 8y ago
    Firefox reader mode works.
deleted 8y ago
[deleted]
jaybosamiya 8y ago
Hi! It looks like I'd forgotten to update the CSS in one portion, due to this, on medium-sized screens, there was an overlap that occurred. This should be fixed now.

saagarjha 8y ago

Really interesting bug in TurboFan's optimizer; getting Math.expm1 handling -0 incorrectly to removing bounds checks by dancing around multiple optimization passes was quite illuminating. Although, later in the exploit, it seems like using WebAssembly creates a RWX page? Why is Chrome doing this for WebAssembly when it stopped doing this for JavaScript, for obvious reasons?

kentonv 8y ago
V8 WebAssembly TLM Ben Titzer explained in a previous HN comment: https://news.ycombinator.com/item?id=18812449 https://news.ycombinator.com/item?id=18812449

Karlax 8y ago

Impressively, Shellphish solved this challenge in 3 hours. The CTF's interactive leaderboard is fun to play with: https://archive.aachen.ccc.de/35c3ctf.ccc.ac/ https://archive.aachen.ccc.de/35c3ctf.ccc.ac/

aboutruby 8y ago

And those Hacker News, Reddit and Twitter messages from Cloudflare employees about their VM-less workers's security will be gold in the future.

kentonv 8y ago

Andrea Biondo did a writeup of the same CTF which I liked a lot. https://abiondo.me/2019/01/02/exploiting-math-expm1-v8/ https://abiondo.me/2019/01/02/exploiting-math-expm1-v8/ EDIT: Previous HN discussion on Andrea's writeup: https://news.ycombinator.com/item?id=18808488 https://news.ycombinator.com/item?id=18808488

jtwaleson 8y ago

Wow, I feel very dumb after reading this.

fwip 8y ago
It shouldn't make you feel dumb - it should just make you aware of the incredible breadth and depth of human knowledge out there. For every single field, there is so much to learn and know. People often underestimate how complex their sister-fields are. You know enough to be dangerous, but not enough to know how much you don't know.

jaybosamiya 8y ago

Hi! Author here. Happy to answer any questions.

brokenmachine 8y ago

Can anyone explain the bug and how it was exploited in simpler terms?