14 ms·
Chrome zero-day released on GitHub – fixed on V8 but still works on latest
- saurik 6y agoSo what I really want to know is: what happens at Cloudflare--which uses v8 to implement Cloudflare Workers in shared memory space--when this kind of stuff happens? (Their use is in some sense way more "out on a limb" than a web browser, where you would have to wait for someone to come to your likely-niche page rather than just push the attack to get run everywhere.)
- deleted 6y ago[deleted]
- viraptor 6y ago> which uses v8 to implement Cloudflare Workers in shared memory space I'm curious how that works in practice. Specifically, the docs say (https://developers.cloudflare.com/workers/learning/how-workers-works https://developers.cloudflare.com/workers/learning/how-worke...) > Each isolate's memory is completely isolated, so each piece of code is protected from other untrusted or user-written code on the runtime. But they don't quite specify if it's isolated at system level (separate threads with unshared memory) or something simpler ("you can't use native code, so v8 isolates your objects").
- kentonv 6y agoHere's a blog post about the Workers security model: https://blog.cloudflare.com/mitigating-spectre-and-other-security-threats-the-cloudflare-workers-security-model/ https://blog.cloudflare.com/mitigating-spectre-and-other-sec... And here's a talk I gave about how Workers works more generally (not security-focused): https://www.infoq.com/presentations/cloudflare-v8/ https://www.infoq.com/presentations/cloudflare-v8/
- nikisweeting 6y agoThis page of documentation is also one of my favorite reads in the last month: https://developers.cloudflare.com/workers/learning/security-model https://developers.cloudflare.com/workers/learning/security-... So many juicy details and nuanced takes that really make me appreciate the thought and care CF has put into securing workers.
- brundolf 6y agoWhat kind of exploit is it (it doesn't say)? Is it possible that further sandboxing levels would isolate the affected instance from other customers pending additional exploits (processes, VMs, etc)? This isn't really my area so apologies if what I'm saying is way off base :P
- kentonv 6y agoThis is what happens: Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in progress now. It will be everywhere within a couple hours. Rolling out an update like this causes no visible impact to customers. In comparison, when a zero-day is dropped in a VM implementation used by a cloud service, it generally takes much longer to roll out a fix, and often requires rebooting all customer VMs which can be disruptive. > Their use is in some sense way worse than a web browser, where you would have to wait for someone to come to your likely-niche page rather than just push the attack to get run everywhere. I may be biased but I think this is debatable. If you want to target a specific victim, it's much easier to get that person to click a link than it is to randomly land on the same machine as them in a cloud service.
- lazypenguin 6y agoThere is something so pleasing about this process being so fully automated that it can be managed in a few clicks. Kudos, I love reading things like this.
- tatersolid 6y agoWhat checks do you perform on that upstream code before building and running it? I imagine a supply-chain attack would be devastating, even if the code only made it to canaries. Your build infrastructure at least could easily be compromised by a nefarious makefile addition.
- kentonv 6y agoSomeone would have to get a malicious patch merged into Google's V8 release branch first. I also personally do a sanity-check review of the patches before rolling out the update.
- Thaxll 6y agoPretty interesting, so people don't have to follow updates on those major projects, your pipeline actually does it for you.
- jeswin 6y ago> you would have to wait for someone to come to your likely-niche page There are a few ad networks which allow you to run JS. They may not work for this specific exploit, though.
- lxe 6y agoSo what does it do? https://github.com/r4j0x00/exploits/blob/7ba55e5ab034d05877498e83f144e187d3ddb160/chrome-0day/exploit.js#L96 https://github.com/r4j0x00/exploits/blob/7ba55e5ab034d058774...
- mappu 6y agoI converted it to binary with a pack("L", ...) loop and loaded it in Ghidra as a raw x86_64 binary. I don't fully understand it, but i think it's searching the address space for some kind of function entry point and then calling it with "calc.exe". So probably the standard PoC shellcode.
- lights0123 6y agoFor anyone else wanting to analyze this: echo '\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48 \x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48 \x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9 \x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b \x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40 \x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48 \x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45 \x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40 \x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58 \x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9 \x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01 \x00\x00\x41\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x41\xba\xa6\x95\xbd \x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72 \x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00' > exploit
- pfundstein 6y agois this affecting Edge as well?
- cmeacham98 6y agoIt's a V8 exploit, so Edge (as with all other Chromium-based browsers) is presumably vulnerable, although I do not know if the PoC above works on Edge or not.
- luxuryballs 6y agoDoes this kind of thing impact node apps?
- lights0123 6y agoIt should, but unless you've manually restricted APIs, you could always just run arbitrary code anyways.
- dspillett 6y ago"It depends". But potentially, yes. Depending on the basis of the flaw. It could potentially affect Electron apps too, as they contain both chromium and node - though the content that can be thrown at their internal instances is likely a lot less varied than that seen in the wider internet that your desktop web browser is routinely exposed to.
- kentonv 6y agoNot really. While the bug technically exists on Node, generally people do not use Node to run untrusted JS/Wasm code. Node isn't designed to be a sandbox.
- fistynuts 6y agoPeople install random Node modules every day.
- cryptica 6y agoYes but unlike the browser, Node.js modules all run in a trusted environment anyway (you should never install modules you don't trust) because there are many ways that a malicious module could hijack the main process to read memory or user input so this vulnerability adds nothing.
- est31 6y agoInteresting how it's firing up a wasm instance to gain access to rwx memory. See also https://news.ycombinator.com/item?id=26737803 https://news.ycombinator.com/item?id=26737803
- kevingadd 6y agoWe've had multiple exploit chains so far thanks to wasm in v8. IIRC someone developed a full exploit chain to get persistent root on chromebooks with a bug in v8's wasm implementation as the starting point, got a big bug bounty out of that one. That particular exploit also involved some holes in the chrome extensions security model (I believe they addressed them)
- v8dev123 6y agoThis bug didn't bypass our sandbox so everything is safe and no need to panic.
- EE84M3i 6y agoWouldn't it be normal to chain another bug for the actual sandbox escape? So this is one part of the chain.
- titzer 6y agoIt'd be good to raise the priority of process-wide WX and design out RCEs of this type once and for all. I am disappointed that Wasm is on the exploit chain for a bug like this, as I still feel responsible in some way. I know team priorities change, but this one I pushed hard for commitment on before I left.
- v8dev123 6y agoAaaaaand It's not the first time WASM seen in [0] wild. [0] https://bugs.chromium.org/p/chromium/issues/detail?id=835887 https://bugs.chromium.org/p/chromium/issues/detail?id=835887
- titzer 6y agoYeah. And it's not even bugs in the Wasm engine that are the problem; the RWX memory for Wasm JIT code makes all other bugs into potential RCE bugs. It must be banished! :)
- saurik 6y agoHere is an article with a lot more detail (high level, not technical) about this... on a random website none of us have ever heard of and so which might be a phishing attack for people like me who immediately went to Google to find more information (and with a few "shockers" in--such as Chrome and Edge not having patched it yet, despite the patch dropping a week ago--to maybe get some viral sharing, such as what I am doing now ;P). https://therecord.media/security-researcher-drops-chrome-and-edge-zero-day-on-twitter/ https://therecord.media/security-researcher-drops-chrome-and...
- gruez 6y agoThe screenshot suggests that all you need to do for the exploit to work is to open the html/js file, but doing this on windows just results in "Aw, Snap!" page. Others in this thread have confirmed this.
- saurik 6y agoThe article says the exploit code released to GitHub doesn't include a sandbox escape, so that seems about like what I would expect: the renderer crashed. (The screenshot is from the researcher, who either has a more complete implementation with another maybe-undisclosed bug or has simply disabled some sandbox restrictions to help test the exploit in isolation or something.)
- danielyaa5 6y agoIm just curious on thoughts about sharing these on twitter. Shouldn't they be shared directly with Google. Since its web people can create exploits pretty quickly.
- saagarjha 6y agoGoogle knows about (and has patched) the bug already. The exploit code has been shared wholesale.
- danielyaa5 6y agoare these patches in place without user updates?
- saagarjha 6y agoNo, they haven't rolled out yet.
- hbrundage 6y agohttps://therecord.media/security-researcher-drops-chrome-and-edge-zero-day-on-twitter/ https://therecord.media/security-researcher-drops-chrome-and... says this isn't a fully weaponizable exploit because you still need to escape the Chrome sandbox after using this. But, the researcher shows a screenshot of having started calc.exe which seems like something that'd happen outside the sandbox?
- saurik 6y agoI would imagine the researcher showed a screenshot of the exploit being run on a copy of Chrom{e,ium} where he had disabled parts of the sandbox (that, or he has a more complex exploit with another maybe-undisclosed sandbox escape).
- r4j0x00 6y agoHey I'm the exploit author, just run "chrome.exe --no-sandbox exploit.html" it will work.
- superjan 6y agoWhat is your motivation of putting it on github? Have you considered selling it to google?
- albntomat0 6y agoThe bug was originally submitted to Google as part of Pwn2Own by two other people. The GitHub POC was built using the patch and regression test by a third person (who you just replied to). While it's been patched in the v8 Javascript engine, that patch has not made it to Chrome (unless you're compiling Chromium from scratch) as part of Chrome's 2 week release process.
- rtpg 6y agoThe pr adding this says that you need to run chrome with —no-sandbox to get the exploit chain (since they don’t have a sandbox buster right now). Kinda feel like the PR to metasploit is more interesting as a link
- submagr 6y agoCan someone please explain how this hack works? (I am CS major so I know basic stuff but not a hacker)
- titzer 6y agoThis is so irresponsible to disclose vulnerabilities this way. There is a process that many people have worked hard to create whereby vulnerabilities can be disclosed, patched--you can even be rewarded!--and both fix and bug are eventually made public in proper time. I am just smh over this.
- jacquesm 6y agoYou can't assume good faith on the part of your attacker in building your threat model. Also: it could have been much worse than this irresponsible disclosure, at least it was disclosed.
- deleted 6y ago[deleted]
- adr_ 6y agoI think Google already publicly disclosed the code to trigger this vulnerability: https://chromium.googlesource.com/v8/v8/+/fd29e246f65a7cee130e72cd10f618f3b82af232%5E%21/#F0 https://chromium.googlesource.com/v8/v8/+/fd29e246f65a7cee13...
- rasz 6y agomy patch: delete WebAssembly injected with uBlock into every browser context before page loads.
- phist_mcgee 6y agoWhat's the slowdown like on this? Any stuttering?
- rasz 6y agoublock is already executing in context of every loaded page, this is just one more line of js. The only website I use that could benefit from webassembly is twitch, but thankfully they detect webassembly capability and their fallback js webworker is working just fine.
- varenc 6y agoHow do you have uBlock do this?
- rasz 6y agoCheck "I am an advanced user (required reading)", enter advanced-settings.html, last line is where you define your own uBlock scriptlets. Then in My Filters define *##+js(myscript) this will inject into every(1) executable context of every page. You still need to hotpatch workers/sharedworkers/webworkers(I disable the last one entirely). This way you get some of the control over Chrome browser back. Not so fun fact - Google is very against users having the ability to execute arbitrary user defined code, afair Gorhill had a problem with google concerning injectable scriptlets. (1) of course there are issues, you cant inject into <iframe src="data: https://github.com/whatwg/html/issues/1753 https://github.com/whatwg/html/issues/1753 in Chrome :( so you would have to manipulate CSP to disable those.
- throwbacktictac 6y agoI have uBlock disable all javascript and make permanent and temporary exceptions when I need to. It's really made browsing the web cumbersome. The more I'm aware of new 0-days the more I appreciate the tar I've laid before myself. Thanks for the info about 'delete WebAssembly'
- person_of_color 6y agoKind of depressing an 18 year old was able to do this.
- CyberRabbi 6y agoDo not casually browse the web with JavaScript enabled. The idea of trustless secure computing is compelling but it’s ultimately not reality. There is a new browser engine rce vulnerability on a regular basis, whether it’s chrome or mobilesafari
- 8128js8121 6y agoyeah k, ill use my notepad
- CyberRabbi 6y agoYou don’t have to use your notepad. You can just disable JavaScript. Vast majority of text content sites work fine. You always have the option to use JavaScript for sites you explicitly trust.
- lcall 5y agoChromium (or iridium), while having other downsides, makes it somewhat convenient in the settings to specify per site whether JS, cookies, or images are allowed or blocked, and also lets one leave separate config tabs open to toggle images, javascript, and cookies on quickly when needed, browsing with them off the rest of the time. Edit: critiques welcome of course.
- fsflover 6y agoOr, you know, simply do whatever you want in a VM.
- CyberRabbi 6y agoYou cannot browse through a VM locally on iOS.
- tannhaeuser 6y agoThe dependency of a whole industry on Chrome, and the fact a 18 year-old can create a WASM exploit for it with ease (which just might be the tip of the iceberg) is really, really scary.
- berkes 6y agoHow do you know about the 'with ease' part?
- tannhaeuser 6y agoWell the age sets an upper bound for the effort put into it, doesn't it?
- tester34 6y agonot rly
- chmod775 6y agoNot really. I was much more focused and arguably a better coder at 18, albeit a somewhat less knowledgeable one. At 26 I have twice the experience but only a third of the motivation and focus. When you're younger you do stuff just find out whether you can, when you're older you already know you could and decide not to do anything. It's exceedingly rare I'll find something interesting enough that'll keep me coding for 15 hours straight, at 18 that was the norm on pretty much every free day - of which there are a lot more when you're younger and not already working as a software dev. My money will always be on the 18 year olds.
- CyberRabbi 6y ago> My money will always be on the 18 year olds. That is not only problematic but also illegal in certain contexts
- sim_card_map 6y agoSo WebAssembly is basically Flash in terms of security?
- saagarjha 6y agoNot at all. Flash was pretty much built insecure, WebAssembly runs in a sandbox by default (and this exploit does not break out of it).
- kevingadd 6y agoKind of a dishonest characterization - Flash was sandboxed too. WASM is simply easier to sandbox and has additional constraints that make it easier to keep code from trying to break out.
- charcircuit 6y agoThe parent was talking about how the process the WASM runtime is in is sandboxed. I could be wrong, but I don't think flash did this. I think the sandbox was more of just some limitations on the APIs you were provided.
- kevingadd 6y agoMost modern browsers started running plugins (including Flash) in a sandbox long before WASM or asm.js existed. Firefox's was named 'plugin-container' and for a while its multiprocess support actually piggybacked on that process to do non-plugin things.
- AnIdiotOnTheNet 6y agoAs with everything, it is only as secure as its implementation. I do take some small pleasure in this though, having had to listen to so many people saying how much Flash had to die and WASM totally wasn't going to cause similar problems.
- heljara 6y agoTo add some further context that isn't written here, the exploit developer here has been tinkering around with v8 for a while. Last year he published a vulnerable VM to HackTheBox (a CTF platform) called RopeTwo[1], where the initial entry point looked extremely similar to this. Its largely regarded as one of the most difficult challenges to solve to date. 1. https://www.hackthebox.eu/home/machines/profile/260 https://www.hackthebox.eu/home/machines/profile/260
- yamrzou 6y agoSee also this interesting series by Google Project Zero https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html https://googleprojectzero.blogspot.com/2021/01/introducing-i... about some recent Chrome 0-days that seem to have been exploited by “Western government operatives actively conducting a counterterrorism operation”. This is to say that with enough time, a sufficiently sophisticated and motivated actor can always find 0-days and achieve their goals. The related article was discussed recently: https://news.ycombinator.com/item?id=26590862 https://news.ycombinator.com/item?id=26590862
- chmod775 6y agoAh yes. Perfect timing. Just 2 days after I was heavily downvoted for saying that you're not particularly safe if you don't disable JS. This absolutely made my day. HN truly is a source of nonstop entertainment.
- ShaneMcGowan 6y ago"Particularly safe" is a bit alarmist, one could make the same argument about literally anything that connects to a public network isn't particularly safe
- chmod775 6y agoIt isn't particularly safe compared to having JS disabled. RCE exploits, stealthy CSRFs, etc. that work with JS disabled are exceedingly rare compared their JS counterparts. This is quantifiable, not "alarmist".
- stinos 6y agoI.e. disabling JS is all fine, but in the end it is just 'safer' and whether or not that is already 'particularily safe' is a rather subjective thing.
- deleted 6y ago[deleted]
- superjan 6y agoYeah, today’s browsers remind me of flash and acrobat: they add features faster than they can fix security bugs. And those features are default on for everyone to exploit. Yeah, I know the comparison is a hyperbole.
- bibinou 6y agoIf it's got a fix it's not a zero-day.
- albntomat0 6y agoI think this one is in a weird place. The fix exists in the v8 source, but hasn't reached normal Chrome yet. Unless an org is compiling Chromium from scratch, there isn't an actual useful fix available.
- albntomat0 6y agoFor those looking to learn the basics of v8 exploitation, there have been a handful of CTF problems on it, including the following recent ones (many with writeups!): - PicoCTF 2021: Kit Engine, Download Horsepower and Turboflan - Hack The Box (HTBs): RopeTwo and Modern Typer - DownUnderCTF 2020: Is This Pwn or Web - LineCTF: BabyChrome
- kmfpl 6y agoPeople in this thread seem very confused about a lot of stuff so I’m going to try and make some clarifications: 1) This is an RCE, so what it does is achieving code execution in the browser, i.e. it can run arbitrary code from the attacker, it’s literally like running a compiled program inside the target’s browser. This doesn’t bypass Chrome’s sandbox, so a lot of OS operations are not reachable from within the browser (for example, a lot of syscalls can’t be called). This is the first step in an exploit chain, the second one would be a sandbox escape to expand the attack surface and do nasty stuff, or maybe a kernel exploit to achieve even higher privileges (such as root) 2) WASM being RWX is really not a security flaw. W^X protections in modern times (even in JIT-like memory mappings) makes sense only when coupled with a strong CFI (control flow integrity) model, which basically tries to mitigate code reuse attacks (such as JOP or ROP). Without this kind of protection, which needs to be a system-wide effort as iOS has shown, W^X makes literally zero sense, since any attacker can easily bypass it by executing an incredibly small JOP/ROP chain that changes memory protections in the target area to run the shellcode, or can even mmap RWX memory directly.