Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Google Chrome Exploitation – A Case Study

Summary: Unit 42 published a case study of geohot's Pwn2Own 2014 winning exploit for a bug in Chrome 33's ArrayBuffers, where overriding an ArrayBuffer's byteLength getter tricked the V8 engine into building a Typed Array of arbitrary size and gave relative read/write across the 32-bit memory space. The write-up details how PartitionAlloc's partitioned heap, 0x200000-byte super-pages and guard pages complicated turning that into absolute read/write and code execution, and notes that later Chromium changes fragmenting super-pages into writable and reserved pages made parts of the technique irrelevant.

What you should know: The exploit still required a separate sandbox bypass to achieve full compromise, so a single Chrome bug was never the whole attack surface. The techniques that defeated PartitionAlloc in Chrome 33 were closed off by later Chromium mitigations, which is the concrete argument for keeping browsers current rather than relying on any one hardening layer.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related