3 ms·

JIT-less should really be the default on the web. The security implications of RWX memory are just so bad, and the amount of time that an exotic JIT meaningfull

by gok 8y ago

JIT-less should really be the default on the web. The security implications of RWX memory are just so bad, and the amount of time that an exotic JIT meaningfully improves behavior of real world web browsing (as opposed to JavaScript benchmarks) is limited. For the rare web app where a JIT is critical, a simple "Do you really trust this web page to perform a lot of computation?" dialog would mitigate a lot of zero-click/one-click attacks.

jayshua 8y ago
Anyone know how common attacks that take advantage of the JIT technology actually are?
- landr0id 8y ago
  It's been used consistently to get initial code execution on the PlayStation 4, iOS (for attacks involving just following a web link), and probably used pretty consistently other nation-state attacks but I have no real data to back this up. The Pegasus spyware for instance utilized a JIT attack in JavaScriptCore in Safari for the initial stage.
- olliej 8y ago
  the RWX memory in JSC has frequently been used as the start of full remote code execution, but has become progressively harder to abuse over the years (via W^X and in newer hardware PAC).
hashseed 8y ago
V8 already employs W^X, i.e. memory pages allocated for V8's heap are either writable or executable, but not both at the same time.
- gok 8y ago
  Well, except for WebAssembly. But even then, it's still fundamentally possible to hijack control of whatever changes the pages from RW to RX.
- MikeHolman 8y ago
  By allowing JIT at all, a small ROP chain can call VirtualProtect to make a larger payload executable. Sure you can do everything with ROP, but it is less convenient (and Intel CET might eventually make ROP attacks actually hard).
kllrnohj 8y ago
> The security implications of RWX memory are just so bad Such as? Any practical examples here? Code executions is code execution. RWX just lets you execute faster code, it doesn't give you any privileges or permissions you didn't otherwise already have.
- gok 8y ago
  https://www.jaybosamiya.com/blog/2019/01/02/krautflare/ https://www.jaybosamiya.com/blog/2019/01/02/krautflare/
  - kllrnohj 8y ago
    Which didn't need RWX by using ROP chains instead...? The security vulnerability there was that the process had the ability to invoke shell at all, not how they got to invoking shell. In-process sandboxing isn't a thing anymore, spectre proved that. In that context what risk does RWX actually pose?

by gok 8y ago

jayshua 8y ago

Anyone know how common attacks that take advantage of the JIT technology actually are?

landr0id 8y ago
It's been used consistently to get initial code execution on the PlayStation 4, iOS (for attacks involving just following a web link), and probably used pretty consistently other nation-state attacks but I have no real data to back this up. The Pegasus spyware for instance utilized a JIT attack in JavaScriptCore in Safari for the initial stage.
olliej 8y ago
the RWX memory in JSC has frequently been used as the start of full remote code execution, but has become progressively harder to abuse over the years (via W^X and in newer hardware PAC).

hashseed 8y ago

V8 already employs W^X, i.e. memory pages allocated for V8's heap are either writable or executable, but not both at the same time.

gok 8y ago
Well, except for WebAssembly. But even then, it's still fundamentally possible to hijack control of whatever changes the pages from RW to RX.
MikeHolman 8y ago
By allowing JIT at all, a small ROP chain can call VirtualProtect to make a larger payload executable. Sure you can do everything with ROP, but it is less convenient (and Intel CET might eventually make ROP attacks actually hard).

kllrnohj 8y ago

> The security implications of RWX memory are just so bad Such as? Any practical examples here? Code executions is code execution. RWX just lets you execute faster code, it doesn't give you any privileges or permissions you didn't otherwise already have.

gok 8y ago
https://www.jaybosamiya.com/blog/2019/01/02/krautflare/ https://www.jaybosamiya.com/blog/2019/01/02/krautflare/
- kllrnohj 8y ago
  Which didn't need RWX by using ROP chains instead...? The security vulnerability there was that the process had the ability to invoke shell at all, not how they got to invoking shell. In-process sandboxing isn't a thing anymore, spectre proved that. In that context what risk does RWX actually pose?