Butterfly Effect and Program Mistake ---- Exploit an "Unexploitable" Chrome Bug

No ratings

Presented at syscan 2017 by

Guang Gong

ABSTRACT Does the flap of a butterfly’s wings in Brazil set off a tornado in Texas? I don’t know. But I do know a negligible tiny logical bug in v8 engine can lead to remote code execution in Chrome. In PwnFest contest 2016, I exploited a logical mistake(CVE-2016-9651) in v8 engine to gain remote code execution. This logical mistake was very small and It appeared unexploitable at first glance. But by the combination of several unusual exploitation tricks, I finished a stable exploit at last. The journey of exploiting this vulnerability tells me: Never give up easily on “unexploitable” bugs. In this talk, I will firstly introduce the "invisible" private property in v8 engine, then disclose the logical mistake related with private property, after that I'll detail how to exploit this tiny bug to gain remote code execution especially the trick of turning an OOB read vulnerability to an OOB write vulnerabilty.