Exploit the possiblities

Chakra CFG Bypass By Overwriting JavaScript Bytecode

Chakra CFG Bypass By Overwriting JavaScript Bytecode
Posted Dec 5, 2017
Authored by Ivan Fratric, Google Security Research

Chakra suffers from a CFG bypass by overwriting JavaScript bytecode.

tags | advisory, javascript
MD5 | 9e57eaebd2d21e12b8ff2602894b0871

Chakra CFG Bypass By Overwriting JavaScript Bytecode

Change Mirror Download
Chakra: CFG bypass by overwriting JavaScript bytecode 

Assume an attacker has the ability to overwrite Chakra's bytecode, either through a read/write primitive or through an overflow type vulnerability. Let's take a look at the ArgOut_A bytecode instruction which is implmented in InterpreterStackFrame::OP_ArgOut_A:

template <class T>
void InterpreterStackFrame::OP_ArgOut_A(const unaligned T * playout)
SetOut(playout->Arg, GetReg(playout->Reg));

And let's take a look at SetOut and GetReg functions:

inline void InterpreterStackFrame::SetOut(ArgSlot outRegisterID, Var aValue)
Assert(m_outParams + outRegisterID < m_outSp);
m_outParams[outRegisterID] = aValue;

template <typename RegSlotType>
Var InterpreterStackFrame::GetReg(RegSlotType localRegisterID) const
Var value = m_localSlots[localRegisterID];
return value;

Note there is an Assert() in SetOut() but that won't affect the behavior of the release version. Similarly, ValidateRegValue will only actually perform validation in the debug build.

If we can corrupt the bytecode of the ArgOut_A instruction (pointed to by playout) we can *read* an out-of-bounds value in GetReg() and then also *write* it out-of-bounds in SetOut. Note that out-of-bounds read/write here is limited in the sense that both playout->Arg and playout->Reg are 8-bit values but it is sufficient for our purpose.

If we already have a read/write primitive, this normally wouldn't give us new capabilities. But note that both m_outParams and m_localSlots actually point on the stack. Thus modifying the ArgOut_A layout will also give us a limited read/write primitive on the stack, which allows us to bypass CFG. For example, we might read some value we control in GetReg() and then use SetOut() to overwrite a return address, thus bypassing CFG. We might also read out a memory from the stack using GetReg() and then write it somewhere where we can extract it using JavaScript.

Note #1: There are other instructions that behave similarly such as ProfiledArgOut_A and ArgOut_Env

Note #2: These are most likely not the only bytecode instructions that allow an attacker to bypass CFG. In fact by dumb-fuzzing the bytecode and then interpreting it it is fairly easy to get RIP to point outside of the executable memory.

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.

Found by: ifratric


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?

Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

March 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    14 Files
  • 2
    Mar 2nd
    12 Files
  • 3
    Mar 3rd
    1 Files
  • 4
    Mar 4th
    3 Files
  • 5
    Mar 5th
    15 Files
  • 6
    Mar 6th
    23 Files
  • 7
    Mar 7th
    15 Files
  • 8
    Mar 8th
    15 Files
  • 9
    Mar 9th
    3 Files
  • 10
    Mar 10th
    2 Files
  • 11
    Mar 11th
    1 Files
  • 12
    Mar 12th
    16 Files
  • 13
    Mar 13th
    20 Files
  • 14
    Mar 14th
    12 Files
  • 15
    Mar 15th
    10 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2018 Packet Storm. All rights reserved.

Security Services
Hosting By