5 ms·

Google Chrome Zero Day CVE-2021-4102, Use after free in V8

sharmin123 5y ago
Signs Of A Cheating Girlfriend: Gather Proof To Make A Decision: https://www.hackerslist.co/signs-of-a-cheating-girlfriend-gather-proof-to-make-a-decision/ https://www.hackerslist.co/signs-of-a-cheating-girlfriend-ga...
vitus 5y ago
IMO the most important line in that blog post is: > Google is aware of reports that an exploit for CVE-2021-4102 exists in the wild.
- staticassertion 5y ago
  Indeed. At one point this was a bigger deal, now it seems that this is the new normal. Chrome bought a good decade or so of security for itself by leveraging sandboxing, but it seems that attackers have gotten their bearings, so here we are. I'm curious though. 4102 is a v8 vulnerability. That shouldn't be sufficient to take over a computer. I wonder if there's another 0day for Windows/Linux that it's being paired with?
  - nieve 5y ago
    Why only Windows and Linux, but not macOS?
    - staticassertion 5y ago
      I honestly just forgot about it
josephscott 5y ago
How does this impact v8 based services, like Cloudflare Workers?
- gruez 5y ago
  Probably not much. I remember seeing a comment from someone that works at cloudflare, saying that they could deploy changes within hours. edit: >Fortunately, we have an advantage here, in that we directly control the machines on which our system runs. We have automated almost our entire build and release process, so the moment a V8 patch is published, our systems automatically build a new release of the Workers Runtime and, after one-click sign-off from the necessary (human) reviewers, automatically push that release out to production. >As a result, our patch gap is now under 24 hours. A patch published by V8's team in Munich during their work day will usually be in production before the end of our work day in the US. https://blog.cloudflare.com/mitigating-spectre-and-other-security-threats-the-cloudflare-workers-security-model/ https://blog.cloudflare.com/mitigating-spectre-and-other-sec...
- tomjen3 5y ago
  Or anything running on NodeJS?
- jgrahamc 5y ago
  We patched when we were notified. And we have a pretty robust model around Workers that is meant to deal with this possibility.
zelon88 5y ago
I am surprised that the altruists at Project Zero didn't find these. When they find zero days in Firefox they make flashy 6 page technical briefs out of it to make sure there's no process failure at Mozilla. To protect Firefox users, of course.
- zetafunction 5y ago
  Project Zero does publish writeups for Chrome bugs. https://googleprojectzero.blogspot.com/2019/04/virtually-unlimited-memory-escaping.html https://googleprojectzero.blogspot.com/2019/04/virtually-unl... is one example. Disclaimer: I am a Chrome developer.
- deleted 5y ago
  [deleted]
- harikb 5y ago
  Technical briefs take time to write and publish. Give them benefit of the doubt
- loeg 5y ago
  Literally the very first critical security bug in this report came from a member of Project Zero.
  - johncena33 5y ago
    It wouldn't be HN if someone doesn't do hot takes.
akomtu 5y ago
Well, if you're using an adblock with JS disabled, you may sleep well.
- Ygg2 5y ago
  Luckily, Google is removing that feature.
  - egberts1 5y ago
    Do … no … evil - some former corporate mantra.
- invalidname 5y ago
  Or if you're using FireFox... Which is migrating code to Rust where this sort of issue can't happen.
- rvnx 5y ago
  Unless these actors have other ways to convince you to go to their landing page :o)
thekashifmalik 5y ago
This is one class of bugs that would not exist if V8 was written in Rust.
- jgaa 5y ago
  This is one class of bugs that would not exist if javascript was banned.
  - tomjen3 5y ago
    Javascript isn't to blame: bad C++ is. It is 2021 and if you are not putting things in smart pointers, you are doing it wrong.
    - olliej 5y ago
      If it’s a bug in V8 it’s likely either GC or codegen, no amount of smart pointers gets you to being completely safe, but the same applies to all the “safe” languages as well.
    - jgaa 5y ago
      js is the new flash. It's just as annoying, and it's the way bad people do bad things to your computer.
      - catfishx 5y ago
        I cant believe you are comparing JavaScript to flash
- olliej 5y ago
  Unlikely - JS engines do a lot of things that are inherently unsafe - pretty much anything related to garbage collection isn’t doable outside of unsafe{} blocks in rust, which as you might guess are unsafe. I can’t speak for V8, but the majority of UaF in JSC have been due to GC bugs collecting objects early. Being in C++ isn’t relevant. Many other bugs are in things that are doing absurd memory manipulation needed for execution speed of common primitives. The rust implementation of these would also necessarily be unsafe.
iechoz6H 5y ago
Pretty useless page if you are interested in details; link [1] is a search query for `type:bug-security os=Android,ios,linux,mac,windows,all,chrome label:Release-2-M96` which returns no result from `bugs.chromium.org` link [2] is a generic Chrome landing page links [3-7] require Google Login (WTF?) I gave up after that. Edit; I actually didn't give up, I searched `https://bugs.chromium.org/p/chromium/issues/list https://bugs.chromium.org/p/chromium/issues/list` for the associated issue numbers with no results. 1. https://bugs.chromium.org/p/chromium/issues/list?can=1&q=type%3Abug-security+os%3DAndroid%2Cios%2Clinux%2Cmac%2Cwindows%2Call%2Cchrome+label%3ARelease-2-M96 https://bugs.chromium.org/p/chromium/issues/list?can=1&q=typ... 2. https://sites.google.com/a/chromium.org/dev/Home/chromium-security https://sites.google.com/a/chromium.org/dev/Home/chromium-se... 3. https://crbug.com/1263457 https://crbug.com/1263457 4. https://crbug.com/1270658 https://crbug.com/1270658 5. https://crbug.com/1272068 https://crbug.com/1272068 6. https://crbug.com/1262080 https://crbug.com/1262080 7. https://crbug.com/1278387 https://crbug.com/1278387
- tonny747 5y ago
  On the page they state: > Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed. I guess they will open up in the next few days.

Signs Of A Cheating Girlfriend: Gather Proof To Make A Decision: https://www.hackerslist.co/signs-of-a-cheating-girlfriend-gather-proof-to-make-a-decision/ https://www.hackerslist.co/signs-of-a-cheating-girlfriend-ga...

vitus 5y ago

IMO the most important line in that blog post is: > Google is aware of reports that an exploit for CVE-2021-4102 exists in the wild.

staticassertion 5y ago
Indeed. At one point this was a bigger deal, now it seems that this is the new normal. Chrome bought a good decade or so of security for itself by leveraging sandboxing, but it seems that attackers have gotten their bearings, so here we are. I'm curious though. 4102 is a v8 vulnerability. That shouldn't be sufficient to take over a computer. I wonder if there's another 0day for Windows/Linux that it's being paired with?
- nieve 5y ago
  Why only Windows and Linux, but not macOS?
  - staticassertion 5y ago
    I honestly just forgot about it

josephscott 5y ago

How does this impact v8 based services, like Cloudflare Workers?

gruez 5y ago
Probably not much. I remember seeing a comment from someone that works at cloudflare, saying that they could deploy changes within hours. edit: >Fortunately, we have an advantage here, in that we directly control the machines on which our system runs. We have automated almost our entire build and release process, so the moment a V8 patch is published, our systems automatically build a new release of the Workers Runtime and, after one-click sign-off from the necessary (human) reviewers, automatically push that release out to production. >As a result, our patch gap is now under 24 hours. A patch published by V8's team in Munich during their work day will usually be in production before the end of our work day in the US. https://blog.cloudflare.com/mitigating-spectre-and-other-security-threats-the-cloudflare-workers-security-model/ https://blog.cloudflare.com/mitigating-spectre-and-other-sec...
tomjen3 5y ago
Or anything running on NodeJS?
jgrahamc 5y ago
We patched when we were notified. And we have a pretty robust model around Workers that is meant to deal with this possibility.

zelon88 5y ago

I am surprised that the altruists at Project Zero didn't find these. When they find zero days in Firefox they make flashy 6 page technical briefs out of it to make sure there's no process failure at Mozilla. To protect Firefox users, of course.

zetafunction 5y ago
Project Zero does publish writeups for Chrome bugs. https://googleprojectzero.blogspot.com/2019/04/virtually-unlimited-memory-escaping.html https://googleprojectzero.blogspot.com/2019/04/virtually-unl... is one example. Disclaimer: I am a Chrome developer.
deleted 5y ago
[deleted]
harikb 5y ago
Technical briefs take time to write and publish. Give them benefit of the doubt
loeg 5y ago
Literally the very first critical security bug in this report came from a member of Project Zero.
- johncena33 5y ago
  It wouldn't be HN if someone doesn't do hot takes.

akomtu 5y ago

Well, if you're using an adblock with JS disabled, you may sleep well.

Ygg2 5y ago
Luckily, Google is removing that feature.
- egberts1 5y ago
  Do … no … evil - some former corporate mantra.
invalidname 5y ago
Or if you're using FireFox... Which is migrating code to Rust where this sort of issue can't happen.
rvnx 5y ago
Unless these actors have other ways to convince you to go to their landing page :o)

thekashifmalik 5y ago

This is one class of bugs that would not exist if V8 was written in Rust.

jgaa 5y ago
This is one class of bugs that would not exist if javascript was banned.
- tomjen3 5y ago
  Javascript isn't to blame: bad C++ is. It is 2021 and if you are not putting things in smart pointers, you are doing it wrong.
  - olliej 5y ago
    If it’s a bug in V8 it’s likely either GC or codegen, no amount of smart pointers gets you to being completely safe, but the same applies to all the “safe” languages as well.
  - jgaa 5y ago
    js is the new flash. It's just as annoying, and it's the way bad people do bad things to your computer.
    - catfishx 5y ago
      I cant believe you are comparing JavaScript to flash
olliej 5y ago
Unlikely - JS engines do a lot of things that are inherently unsafe - pretty much anything related to garbage collection isn’t doable outside of unsafe{} blocks in rust, which as you might guess are unsafe. I can’t speak for V8, but the majority of UaF in JSC have been due to GC bugs collecting objects early. Being in C++ isn’t relevant. Many other bugs are in things that are doing absurd memory manipulation needed for execution speed of common primitives. The rust implementation of these would also necessarily be unsafe.

iechoz6H 5y ago

Pretty useless page if you are interested in details; link [1] is a search query for `type:bug-security os=Android,ios,linux,mac,windows,all,chrome label:Release-2-M96` which returns no result from `bugs.chromium.org` link [2] is a generic Chrome landing page links [3-7] require Google Login (WTF?) I gave up after that. Edit; I actually didn't give up, I searched `https://bugs.chromium.org/p/chromium/issues/list https://bugs.chromium.org/p/chromium/issues/list` for the associated issue numbers with no results. 1. https://bugs.chromium.org/p/chromium/issues/list?can=1&q=type%3Abug-security+os%3DAndroid%2Cios%2Clinux%2Cmac%2Cwindows%2Call%2Cchrome+label%3ARelease-2-M96 https://bugs.chromium.org/p/chromium/issues/list?can=1&q=typ... 2. https://sites.google.com/a/chromium.org/dev/Home/chromium-security https://sites.google.com/a/chromium.org/dev/Home/chromium-se... 3. https://crbug.com/1263457 https://crbug.com/1263457 4. https://crbug.com/1270658 https://crbug.com/1270658 5. https://crbug.com/1272068 https://crbug.com/1272068 6. https://crbug.com/1262080 https://crbug.com/1262080 7. https://crbug.com/1278387 https://crbug.com/1278387

tonny747 5y ago
On the page they state: > Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed. I guess they will open up in the next few days.