3 ms·

Surely it's not possible to run untrusted arbitrary straight on the metal assembly from the browser? Or if so, the only via JS VM exploits that could be patched

by klik99 5y ago

Surely it's not possible to run untrusted arbitrary straight on the metal assembly from the browser? Or if so, the only via JS VM exploits that could be patched via browser updates, right? Not having the ability to exploit machine metal level exploits via browser in a way that can't be patched via security updates seems like progress, even though it it's progress with a lot of caveats. If I'm wrong, I'm reinstalling all my noscript extensions... Of course, as a non-security guy, I'm still shocked that signed windows binaries can load unsigned dlls without any warnings - at least os x has some checks around this - so maybe I'm just naive

garmaine 5y ago
You don't need to run straight on the metal assembly to exploit processor bugs. In this particular case of the Pentium F00F bug, I admit it seems difficult to tease a JIT compiler to generate such an instruction as it is not in fact a legal x86 instruction according to the ISA. I wouldn't be confident in saying it is impossible though. I've seen weirder things done. But speaking generally as I meant to in my earlier comment, nearly all privilege-escalating processor bugs which have followed have been remote exploitable via the browser's JavaScript JIT compiler. A quick google will get you prototype research implementations of Rowhammer, Spectre, and Meltdown which can be served for execution as script on a webpage and extract information from vulnerable clients.
- saagarjha 5y ago
  Getting full control over the instructions a JIT will produce, which you would need to have it generate invalid instructions, would also let you take over the entire web content process. In this case you also get to lock up the process, which might be more desirable depending on your goals, but it's certainly a logic bug in the JIt (missing bounds check, overflow, etc.) rather than something like Rowhammer, where a JIT might lower your JavaScript for loop into a tight assembly loop that lets you do bad things to the hardware.

by klik99 5y ago

garmaine 5y ago

You don't need to run straight on the metal assembly to exploit processor bugs. In this particular case of the Pentium F00F bug, I admit it seems difficult to tease a JIT compiler to generate such an instruction as it is not in fact a legal x86 instruction according to the ISA. I wouldn't be confident in saying it is impossible though. I've seen weirder things done. But speaking generally as I meant to in my earlier comment, nearly all privilege-escalating processor bugs which have followed have been remote exploitable via the browser's JavaScript JIT compiler. A quick google will get you prototype research implementations of Rowhammer, Spectre, and Meltdown which can be served for execution as script on a webpage and extract information from vulnerable clients.

saagarjha 5y ago
Getting full control over the instructions a JIT will produce, which you would need to have it generate invalid instructions, would also let you take over the entire web content process. In this case you also get to lock up the process, which might be more desirable depending on your goals, but it's certainly a logic bug in the JIt (missing bounds check, overflow, etc.) rather than something like Rowhammer, where a JIT might lower your JavaScript for loop into a tight assembly loop that lets you do bad things to the hardware.