How client-side compilers help attackers to gain code execution

No ratings

Presented at RuhrSecBochum 2018 by

Dr. Gawlik

Compilers of interpreter languages aim at speeding up execution in the race for web browser performance. Various compilers and analysis stages are involved to turn JavaScript code into machine code of the architecture the browser runs on. In order to maximize the performance of our indispensable browsers, Just-In-Time (JIT) compilation gained widespread adoption. It achieves near-native run time for otherwise slowly interpreted JavaScript code. But it is only the beginning, and Ahead-of-Time (AOT) compilers such as ASM.JS and its successor WebAssembly are emerging and won't disappear any time soon. Despite the intended performance gain, security concerns arise.Attackers started to abuse JIT compilers by emitting desired machine code derived from controlled script constants. Armed with the ability to fill predictable address regions with hidden assembly instructions, they invented the JIT-Spray technique. Since then, many client-side JIT-Spray primitives were developed to ease the exploitation of various memory errors, which we'll revisit in the beginning of this presentation. Furthermore, we analyze flaws we found in ASM.JS of Mozilla Firefox, tracked as CVE-2017-5375 and CVE-2017-5400, allowing an attacker to jump to "JIT" sprayed executable code. Moreover, we take a look at three different Firefox CVEs and demonstrate alternative exploitation with ASM.JS JIT-Spray. On the road to remote code execution, we show how arbitrary ASM.JS payloads are generated and transformed automatically, allowing you to run your favorite code implant on vulnerable Firefox versions.