JITSploitation I: A JIT Bug
Summary: Project Zero's Samuel Groß detailed CVE-2020-9802, a JavaScriptCore JIT compiler bug in which DFGClobberize failed to account for the ArithMode of ArithNegate, letting common-subexpression elimination substitute a checked negation with an unchecked one. The flaw, fixed in iOS 13.5, can yield an out-of-bounds read or write on the JSC heap, and two mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
What's compelling: The bug only manifests when negating INT_MIN, which the author notes makes it very hard for a fuzzer to find by chance - a reminder that some exploitable JIT flaws surface through manual study of optimization logic, not automated scanning, and can stay powerful for a long time.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-9802CVE-2020-9870CVE-2020-9910
- Related
- JITSploitation II: Getting Read/Write Cyber Risks ·JITSploitation III: Subverting Control Flow Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026