Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome zero-day released on GitHub – fixed on V8 but still works on latest

github.com

Post reply on HN
Print view View original

61–70 of 160 posts

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#61

Post by rasz »

cmeacham98 wrote: post #60
rasz wrote: post #44

my patch: delete WebAssembly injected with uBlock into every browser context before page loads.

Considering that JS is JIT'd (and V8 has had JS based RCEs in the past), is there any reason to believe webasm is a significant security hole?

This particular 0-day exploit goes thru webassembly. Other things I disable just in case is for example

    window.AudioContext = undefined
saved me from 2 previous Chrome RCEs.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#62

Post by rasz »

varenc wrote: post #59
rasz wrote: post #44

my patch: delete WebAssembly injected with uBlock into every browser context before page loads.

How do you have uBlock do this?

Check "I am an advanced user (required reading)", enter advanced-settings.html, last line is where you define your own uBlock scriptlets. Then in My Filters define

    *##+js(myscript)
this will inject into every(1) executable context of every page. You still need to hotpatch workers/sharedworkers/webworkers(I disable the last one entirely).

This way you get some of the control over Chrome browser back. Not so fun fact - Google is very against users having the ability to execute arbitrary user defined code, afair Gorhill had a problem with google concerning injectable scriptlets.

(1) of course there are issues, you cant inject into https://github.com/whatwg/html/issues/1753 in Chrome :( so you would have to manipulate CSP to disable those.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#63

Post by moozilla »

rtpg wrote: post #57
hbrundage wrote: post #33

https://therecord.media/security-researcher-drops-chrome-and... says this isn't a fully weaponizable exploit because you still need to escape the Chrome sandbox after using this. But, the researcher shows a screenshot of having started calc.exe which seems like something that'd happen outside the sandbox?

The pr adding this says that you need to run chrome with —no-sandbox to get the exploit chain (since they don’t have a sandbox buster right now). Kinda feel like the PR to metasploit is more interesting as a link

Couldn't find the PR you're referring to, unless it was this one https://github.com/rapid7/metasploit-framework/pull/15007 which was added by the same author as the OP, but looks like a different exploit as far as I can tell?

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#64

Post by rasz »

phist_mcgee wrote: post #58
rasz wrote: post #44

my patch: delete WebAssembly injected with uBlock into every browser context before page loads.

What's the slowdown like on this? Any stuttering?

ublock is already executing in context of every loaded page, this is just one more line of js. The only website I use that could benefit from webassembly is twitch, but thankfully they detect webassembly capability and their fallback js webworker is working just fine.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#65

Post by astrange »

cmeacham98 wrote: post #60
rasz wrote: post #44

my patch: delete WebAssembly injected with uBlock into every browser context before page loads.

Considering that JS is JIT'd (and V8 has had JS based RCEs in the past), is there any reason to believe webasm is a significant security hole?

Supposedly half of wasm deployments recently were malware like secret crypto miners.

https://www.infoq.com/news/2019/10/WebAssembly-wasm-maliciou...

It's probably tolerable to turn it off for now unless you know you need it.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#66

Post by adr_ »

titzer wrote: post #41

This is so irresponsible to disclose vulnerabilities this way. There is a process that many people have worked hard to create whereby vulnerabilities can be disclosed, patched--you can even be rewarded!--and both fix and bug are eventually made public in proper time. I am just smh over this.

I think Google already publicly disclosed the code to trigger this vulnerability: https://chromium.googlesource.com/v8/v8/+/fd29e246f65a7cee13...

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#68

Post by jeswin »

saurik wrote: post #2

So what I really want to know is: what happens at Cloudflare--which uses v8 to implement Cloudflare Workers in shared memory space--when this kind of stuff happens? (Their use is in some sense way more "out on a limb" than a web browser, where you would have to wait for someone to come to your likely-niche page rather than just push the attack to get run everywhere.)

> you would have to wait for someone to come to your likely-niche page

There are a few ad networks which allow you to run JS. They may not work for this specific exploit, though.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#70

Post by nikisweeting »

kentonv wrote: post #11
viraptor wrote: post #5

Earlier quoted context omitted.

> which uses v8 to implement Cloudflare Workers in shared memory space I'm curious how that works in practice. Specifically, the docs say ( https://developers.cloudflare.com/workers/learning/how-worke... ) > Each isolate's memory is completely isolated, so each piece of code is protected from other untrusted or user-written code on the runtime. But they don't quite specify if it's isolated at system level (separate t…

Here's a blog post about the Workers security model: https://blog.cloudflare.com/mitigating-spectre-and-other-sec... And here's a talk I gave about how Workers works more generally (not security-focused): https://www.infoq.com/presentations/cloudflare-v8/

This page of documentation is also one of my favorite reads in the last month: https://developers.cloudflare.com/workers/learning/security-...

So many juicy details and nuanced takes that really make me appreciate the thought and care CF has put into securing workers.

Post reply on HN