From a2d2f8fd28ce9b099c0176a70026384efbd9ac9c Mon Sep 17 00:00:00 2001 From: Man Yue Mo Date: Wed, 29 Jun 2022 09:01:45 +0100 Subject: [PATCH 1/2] Initial commit --- .../Chrome/v8/CVE-2022-1134/README.md | 29 +++ .../Chrome/v8/CVE-2022-1134/superic_rce.html | 232 ++++++++++++++++++ 2 files changed, 261 insertions(+) create mode 100644 SecurityExploits/Chrome/v8/CVE-2022-1134/README.md create mode 100644 SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html diff --git a/SecurityExploits/Chrome/v8/CVE-2022-1134/README.md b/SecurityExploits/Chrome/v8/CVE-2022-1134/README.md new file mode 100644 index 0000000..bf4cd9d --- /dev/null +++ b/SecurityExploits/Chrome/v8/CVE-2022-1134/README.md @@ -0,0 +1,29 @@ +#Chrome renderer RCE CVE-2022-1134 + +The write up can be found [here](https://github.blog/2022-06-29-the-chromium-super-inline-cache-type-confusion/). This is a bug in the v8 that I reported in March 2022. This bug allows RCE in the Chrome renderer sandbox by simply visiting a malicious website. + +The exploit is tested with the Linux official build of Chrome version `99.0.4844.84` with the following revision (this can be checked from `chrome://version`): + +``` +Chromium 99.0.4844.84 (Official Build) (64-bit) +Revision 81a11fc2ee8a41e17451f29195387f276d3bb379-refs/branch-heads/4844_74@{#6} +``` + +For reference, the tested binary is compiled with the following flags, following the instructions to compile Chrome [here](https://chromium.googlesource.com/chromium/src/+/main/docs/linux/build_instructions.md): + +``` +is_debug = false +symbol_level = 2 +blink_symbol_level = 2 +dcheck_always_on = false +is_official_build = true +chrome_pgo_phase = 0 +``` + +To test, host the file `superic_rce.html` and then open it in Chrome with the `--no-sandbox` flag: + +``` +./chrome --user-data-dir=/tmp/chromium_data --no-sandbox +``` + +If successful, it'll pop `xcalc` instantly (on Ubuntu). The exploit should be very reliable and I've not experience any failure with it. diff --git a/SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html b/SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html new file mode 100644 index 0000000..7cc7805 --- /dev/null +++ b/SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html @@ -0,0 +1,232 @@ + + + + + From 0aaf240ef611edcec34631276f4de9fe84cb4f0f Mon Sep 17 00:00:00 2001 From: Man Yue Mo Date: Wed, 29 Jun 2022 16:10:31 +0100 Subject: [PATCH 2/2] Fix link --- .../Chrome/v8/{CVE-2022-1134 => CVE_2022_1134}/README.md | 0 .../Chrome/v8/{CVE-2022-1134 => CVE_2022_1134}/superic_rce.html | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename SecurityExploits/Chrome/v8/{CVE-2022-1134 => CVE_2022_1134}/README.md (100%) rename SecurityExploits/Chrome/v8/{CVE-2022-1134 => CVE_2022_1134}/superic_rce.html (100%) diff --git a/SecurityExploits/Chrome/v8/CVE-2022-1134/README.md b/SecurityExploits/Chrome/v8/CVE_2022_1134/README.md similarity index 100% rename from SecurityExploits/Chrome/v8/CVE-2022-1134/README.md rename to SecurityExploits/Chrome/v8/CVE_2022_1134/README.md diff --git a/SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html b/SecurityExploits/Chrome/v8/CVE_2022_1134/superic_rce.html similarity index 100% rename from SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html rename to SecurityExploits/Chrome/v8/CVE_2022_1134/superic_rce.html