Engineering Heap Overflow Exploits with JavaScript

Engineering Heap Overflow Exploits with JavaScript

Link: https://securityevaluators.com/knowledge/papers/engineeringheapoverflow.pdf

---------------------------------------------------------------------------------
This paper presents a new technique for exploiting heap
overflows in JavaScript interpreters. Briefly, given a heap
overflow, JavaScript commands can be used to insure that
a function pointer is reliably present for smashing, just
after the overflown buffer. A case study serves to highlight
the technique: the Safari exploit that the authors
used to win the 2008 CanSecWest Pwn2Own contest.
1 Introduction
Many buffer and integer overflow vulnerabilities allow
for a somewhat arbitrary set of values to be written at a
relative offset to a pointer on the heap. Unfortunately for
the attacker, often the data following the pointer is unpredictable,
making exploitation difficult and unreliable.
The most ideal heap overflow, in terms of full attacker
control over the quantity and values of overflow bytes,
can be virtually unexploitable if nothing interesting and
predictable is waiting to be overwritten.
Thanks to safe unlinking protections, the heap metadata
structures are often no longer a viable target for
overflows. Currently, application specific data is usually
needed as an overflow target, where normal program flow
results in the calling of a function pointer that has been
overwritten with an attacker supplied shellcode address.
However, such exploits are in no way guaranteed to be
reliable. It must be the case that pointers yet to be accessed
are sitting on the heap after the overflown buffer,
and no other critical data or unmapped memory lies in
between, the smashing of which would result in a premature
crash. Such ideal circumstances can certainly be
rare for an arbitrary application vulnerability.
However, given access to a client-side scripting language
such as JavaScript, an attacker may be able to create
these ideal circumstances for vulnerabilities in applications
like web browsers. In [2], Sotirov describes how
to use JavaScript allocations in Internet Explorer to allow
for attacker control over the target heap. In this paper
we describe a new technique, inspired by his Heap
Feng Shui, that can be used to reliably position function
pointers for later smashing with a heap overflow.
This paper contains a description of the technique followed
by an account of its application to a WebKit vulnerability
discovered by the authors and used to win the
2008 CanSecWest Pwn2Own contest.
---------------------------------------------------------------------------------