Attacking Edge Through the JavaScript Just-In-Time Compiler
No ratings
Presented at BlueHatIL 2019 by
While memory safety mitigations have drastically increased the difficulty of exploiting memory corruption bugs in Microsoft Edge, single bugs in the ChakraCore JavaScript engine are often still powerful enough to construct full exploits. As the core engine has matured over time, attackers and researchers turned to specific and complex aspects such as Just-in-Time compilation to find exploitable vulnerabilities.After introducing some basic ChakraCore internals and the problems of compiling dynamically typed code, this session will dive into ChakraCore's JIT compiler and its compilation phases. Our focus will be on de-mystifying the inner workings of the global optimizer which performs multiple complex optimizations. We’ll examine what kind of bugs can be introduced during this process and how they can be leveraged to compromise the Edge renderer process. As an example, we’ll outline the root cause of CVE-2018-8266, and showcase how to turn it into an arbitrary memory read/write primitive for a full renderer compromise.