WebKit Everywhere: Secure or Not?
summary
Shows a full exploitation chain that turns a CSS selector bug into reliable RCE on x64 Safari and a second demo targeting mobile apps, using a restrictive one-bit write plus a JS-controlled free primitive to convert that into arbitrary read/write. Exploit avoids heap spray by locating JIT pages via a JavaScript memory scan, leaks vtable/text base to defeat ASLR, and writes shellcode into a large buffer. Includes working demos and specific fixes: reduce JS-control-free objects, randomize small allocations, and harden JIT placement.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:42Background
- 3:00Historical issues
- 4:16Memory Corruption
- 5:34Heap Arena
- 6:19RenderArena internals
- 7:11RenderArena enhancement
- 7:45GC mechanism
- 8:35Trigger GC: Workaround
- 10:11ASLR on Mac OSX
- 10:47Sandbox architecture
- 11:15Native 64bit App
- 12:43CVE-2014-1303 : Vulnerability
- 15:27Restrictive 1-bit write
- 16:59Exploit : What to overwrite?
- 18:34Typed Array Internals
- 19:00Exploitation : Overall strategy
- 23:35Exploitation : JS Controlled Free
- 26:17Exploitation : ROPs are for the 99%
- 29:13Summary of WebKit exploitation
