Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome zero-day released on GitHub – fixed on V8 but still works on latest

github.com

Post reply on HN
Print view View original

11–20 of 160 posts

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#11

Post by kentonv »

viraptor wrote: post #5
saurik wrote: post #2

So what I really want to know is: what happens at Cloudflare--which uses v8 to implement Cloudflare Workers in shared memory space--when this kind of stuff happens? (Their use is in some sense way more "out on a limb" than a web browser, where you would have to wait for someone to come to your likely-niche page rather than just push the attack to get run everywhere.)

> which uses v8 to implement Cloudflare Workers in shared memory space I'm curious how that works in practice. Specifically, the docs say ( https://developers.cloudflare.com/workers/learning/how-worke... ) > Each isolate's memory is completely isolated, so each piece of code is protected from other untrusted or user-written code on the runtime. But they don't quite specify if it's isolated at system level (separate t…

Here's a blog post about the Workers security model: https://blog.cloudflare.com/mitigating-spectre-and-other-sec...

And here's a talk I gave about how Workers works more generally (not security-focused): https://www.infoq.com/presentations/cloudflare-v8/

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#12

Post by kentonv »

tatersolid wrote: post #9
kentonv wrote: post #7

Earlier quoted context omitted.

This is what happens: Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in pr…

What checks do you perform on that upstream code before building and running it? I imagine a supply-chain attack would be devastating, even if the code only made it to canaries. Your build infrastructure at least could easily be compromised by a nefarious makefile addition.

Someone would have to get a malicious patch merged into Google's V8 release branch first. I also personally do a sanity-check review of the patches before rolling out the update.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#18

Post by dspillett »

luxuryballs wrote: post #13

Does this kind of thing impact node apps?

"It depends". But potentially, yes. Depending on the basis of the flaw. It could potentially affect Electron apps too, as they contain both chromium and node - though the content that can be thrown at their internal instances is likely a lot less varied than that seen in the wider internet that your desktop web browser is routinely exposed to.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#20

Post by mappu »

lxe wrote: post #15

So what does it do? https://github.com/r4j0x00/exploits/blob/7ba55e5ab034d058774...

I converted it to binary with a pack("L", ...) loop and loaded it in Ghidra as a raw x86_64 binary. I don't fully understand it, but i think it's searching the address space for some kind of function entry point and then calling it with "calc.exe".

So probably the standard PoC shellcode.

Post reply on HN