What Cannot Be Read, Cannot Be Leveraged? Revisiting Assumptions of JIT-ROP...
summary
Demonstrates that JIT-ROP does not need readable code: a JIT compiler is coerced to emit arbitrary three-byte gadgets by controlling displacement fields in conditional jumps and direct-call offsets, then gadget addresses are recovered via leaked function pointers or return addresses. Implements attacks against Chrome, IE11 and Firefox variants (gadget generation takes ~1.3s in Chrome, ~32s average in IE11) and proposes a mitigation that converts relative into indirect addressing with measured 2% performance overhead and 26% code-size overhead.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:17Overview
- 2:33Code Reuse Defenses
- 4:11Execute-no-Read (XnR) Schemes
- 5:08JIT Spraying [WOOT10]
- 6:04Defenses in Browsers
- 7:152B Gadgets
- 9:02Emitting Gadgets via Control Flow Instructions
- 9:47Conditional Jumps in JS
- 11:08Direct Calls in JS
- 13:41Gadgets in Chrome 51 (64-bit)
- 15:10Limitations in Internet Explorer
- 18:16Gadgets in IE 11 (32-bit)
- 18:51Gadgets in Browsers
- 19:49Defense - Direct Calls
- 20:49Defense - Conditional Jumps
- 21:41Defense - Overhead
- 22:30Summary
related talks
35mOn Securing Legacy Software Against Code-Reuse Attacks
37mReviving JIT Vulnerabilities: Unleashing the Power of Maglev Compiler Bugs on Chrome Browser
22mThinking Outside the JIT Compiler
45mAbusing Performance Optimization Weaknesses to Bypass ASLR
55mThe Beast is in Your Memory
33mOver the Edge: Silently Owning Windows 10's Secure Browser
50mWrite Once, Pwn Anywhere
35mThe Hat Trick: Exploit Chrome Twice from Runtime to JIT