4 ms·
In the demo video they're running Chrome using the --no-sandbox flag. Can this be exploited without that option? I can't actually test this myself at the moment
by throwitaway1123 3y ago
In the demo video they're running Chrome using the --no-sandbox flag. Can this be exploited without that option? I can't actually test this myself at the moment, because the vulnerability only works on x86_64 machines.
- bri3d 3y agoYes, it can be exploited, just inside the sandbox. I'm pretty sure this is why the write-up is always so careful to say "read/write inside the Chrome sandbox." With the chain that's documented, you basically end up with full R/W/X control inside of the sandbox process, so what you can do is highly platform and version specific. For example, IIRC you used to be able to unmask Tor and many VPN and proxy users from inside of the sandbox using either JavaScript or native networking APIs. It's my recollection that this is less true on newer Windows versions, but I don't keep up with Chrome sandbox protection that well. Presumably Exodus also have a sandbox escape that didn't get burned so they didn't include it in the writeup.
- throwitaway1123 3y ago> Presumably Exodus also have a sandbox escape that didn't get burned so they didn't include it in the writeup. I certainly hope not. I know these zero day exploits tend to be used almost exclusively against high profile politicians and journalists, but the threat still tempts me to just disable the JIT altogether (and maybe WASM too).