Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting the Math.expm1 typing bug in V8

abiondo.me

Post reply on HN
Print view View original

41–47 of 47 posts

Re: Exploiting the Math.expm1 typing bug in V8

#41

Post by cozzyd »

cozzyd wrote: post #22
zachrose wrote: post #20

Earlier quoted context omitted.

Here's what I don't get. Why isn't Math.expm1 just implemented in JavaScript? Math.expm1 = (x) => Math.pow(Math.E, (x)) - 1; With this monkey patched version, Math.expm1(-0) now returns 0. I've been writing JavaScript for a long time and I didn't even know Math.expm1 was a thing. Was it really necessary to implement this inside V8?

Because you lose all your precision there due to how floating point math eorjsy. expm1 is for very small x that where exp (x) is close to 1.

oops, s/eorjsy/works. That's what I get for typing on my phone in bed at night...

Re: Exploiting the Math.expm1 typing bug in V8

#42

Post by staticassertion »

wahern wrote: post #7
staticassertion wrote: post #4

Earlier quoted context omitted.

I don't know what you mean by AWS? They don't rely on V8 for isolation, they use KVM among many other layers.

I guess I was wrong. Looks like AWS is already using Firecracker for AWS Lambda: https://aws.amazon.com/blogs/aws/firecracker-lightweight-vir... Although it would be nice for AWS to explicitly say that there's one customer per hosted Lambda environment, and distinct from language-level or process-based sandboxing. From the article above you have to assume that because v1 of Lambda put one customer per EC2 instance as…

I believe AWS does share customer information within a device, but with a lot of sandboxing below that. You can watch this talk to learn more: https://www.youtube.com/watch?v=QdzV04T_kec

I think the threat model is basically that you'd need a KVM kernel 0-day + the ability to exploit it, so a point of privilege such as outside of the firecracker sandbox.

Re: Exploiting the Math.expm1 typing bug in V8

#43

Post by EE84M3i »

wglb wrote: post #37
laurentl wrote: post #25

Earlier quoted context omitted.

> it might be an almost archetypical example of the "all bugs are security vulnerabilities" hypothesis This article will be my new go-to example when someone handwaves a bug away with a complacent “it’ll never happen” and “it’s not that big of a deal”. Yes it will, and yes it is.

Right, and it is right up there with https://www.blackhat.com/us-18/briefings/schedule/index.html , whose security value was unappreciated by some very smart folks.

Were you trying to link to a specific briefing? Your link just goes to the full schedule for me.

Re: Exploiting the Math.expm1 typing bug in V8

#44

Post by klodolph »

thanatropism wrote: post #39
klodolph wrote: post #38

Earlier quoted context omitted.

expm1 is not expm, there is no expm in JavaScript (maybe you are thinking of MATLAB)

Do you have to write the Padé approximant by hand or has this already been sorted out in a popular library?

I know what a Padé approximant is but I am not sure how it is relevant. expm1 is available as part of the math library in JavaScript, just as it is also available for C. You do not have to implement it yourself.

The exact implementation depends on your math library, but in glibc it appears to reduce the argument modulo log 2, and then uses an approximation found in part by the Remez algorithm for the exponential function on the range [0, 0.5 log2]. My assumption here is that the Remez algorithm will often be preferred over Padé, but I am not an expert on these things. The Padé approximant gives an approximation “near” a point but the Remez algorithm finds an approximation over an entire interval. In either case, the Remez algorithm is only used to construct one part of the function, and there is also some effort to propagate error from the argument reduction. The resulting algorithm claims For matrix exponentiation you would need a library.

Re: Exploiting the Math.expm1 typing bug in V8

#45

Post by csense »

zachrose wrote: post #20
tptacek wrote: post #3

The fundamental bug here is really slick. The static analyzer in the JIT incorrectly believes Math.expm1(x) can't return -0. But if x is -0, it can. That, in turn, means it believes Object.is(Math.expm(x), -0) must always be false. But if x is -0, it's true, not false. That, in turn, means that the JIT believes array[Object.is(Math.expm(x), -0) * INDEX] must be array[0], no matter what INDEX is. But if x is -0, it'll…

Here's what I don't get. Why isn't Math.expm1 just implemented in JavaScript? Math.expm1 = (x) => Math.pow(Math.E, (x)) - 1; With this monkey patched version, Math.expm1(-0) now returns 0. I've been writing JavaScript for a long time and I didn't even know Math.expm1 was a thing. Was it really necessary to implement this inside V8?

The reason expm1 exists is because that naive approach is numerically poor when x is small (then e^x is almost 1, and subtracting two almost equal values throws away significant digits and gives you an inaccurate result).

Re: Exploiting the Math.expm1 typing bug in V8

#46

Post by wglb »

EE84M3i wrote: post #43
wglb wrote: post #37

Earlier quoted context omitted.

Right, and it is right up there with https://www.blackhat.com/us-18/briefings/schedule/index.html , whose security value was unappreciated by some very smart folks.

Were you trying to link to a specific briefing? Your link just goes to the full schedule for me.

Yes, sorry about that

https://www.blackhat.com/us-18/briefings/schedule/index.html...

Re: Exploiting the Math.expm1 typing bug in V8

#47

Post by librarian42 »

blattimwind wrote: post #30
tokyodude wrote: post #29

Earlier quoted context omitted.

certainly V8 tries to be correct and this bug will be fixed. Chromium's position is "security in depth". They know it's impossible to have zero bugs therefore the entire architure assumes there will be bugs and tries to prevent them from causing any harm. This is also why there are roughly 10x less code execution bugs in chrome vs other browsers. same number of bugs overall but most lead nowhere

> Chromium's position is "security in depth". Yet the exploit in WebSQL a few weeks ago gave RCE from a component directly reachable by page scripts.

Technically that was an SQL injection attack. :)
Post reply on HN