pwn-learning/PwnCollege/V8Exploitation/Level6

Level 6

Problem

Given a vulnerable builtin Array.prototype.functionMap(func):

• It takes a PACKED_DOUBLE_ELEMENTS JSArray receiver and a JSFunction argument.
• reinterpret_cast elements to a FixedDoubleArray, then for each element e:
  • Trigger a custom JavaScript callback func, with
    • Input: this double element e
    • Output: any double element o
  • And store o to e's original position.

Key Knowledge

• Side Effect based Array Element Type Confusion
  • CVE-2018-4233
    • saelo/cve-2018-4233: Exploit for CVE-2018-4233, a WebKit JIT optimization bug used during Pwn2Own 2018
    • Attacking Client-Side JIT Compilers (v2)
    • Pwn2Own 2018 CVE-2018-4233 分析
  • Use this technique to construct Address Of & Fake Object primitive.
• How to build d8 and debug them?
  • Building V8 from source
  • Building V8 with GN