Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome zero-day released on GitHub – fixed on V8 but still works on latest

github.com

Post reply on HN
Print view View original

81–90 of 160 posts

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#81

Post by saagarjha »

kentonv wrote: post #35
saurik wrote: post #25

Earlier quoted context omitted.

Thanks for the response! This didn't really answer what I was curious about, though: like, you answered what happens during the minutes after the fix being pushed, but I am curious about the minutes after the exploit being released, as the mention of "zero day" made me think that this bug could only have been fixed in the past few hours (and so there were likely hours of Cloudflare going "omg what now?" with engineer…

> which patched the bug in the V8 code last week This does not appear to be true. AFAICT the first patch was merged today: https://chromium-review.googlesource.com/c/v8/v8/+/2820971 (It was then rapidly cherry-picked into release branches, after which our automation picked it up.) > I am curious about this because I want to better understand the mitigations in place by a service such as Cloudflare, as I am interested…

Right, the regression test appeared early (soon after Pwn2Own) and the patch was developed based on that.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#82

Post by berkes »

tannhaeuser wrote: post #67

The dependency of a whole industry on Chrome, and the fact a 18 year-old can create a WASM exploit for it with ease (which just might be the tip of the iceberg) is really, really scary.

How do you know about the 'with ease' part?

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#83

Post by tannhaeuser »

berkes wrote: post #82
tannhaeuser wrote: post #67

The dependency of a whole industry on Chrome, and the fact a 18 year-old can create a WASM exploit for it with ease (which just might be the tip of the iceberg) is really, really scary.

How do you know about the 'with ease' part?

Well the age sets an upper bound for the effort put into it, doesn't it?

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#84

Post by lofties »

Xunjin wrote: post #53
bassdropvroom wrote: post #43

Earlier quoted context omitted.

> Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in progress now. It will…

Can you include me too?! I wish I could automate the hell like they do :P

You can!

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#86

Post by chmod775 »

tannhaeuser wrote: post #83
berkes wrote: post #82

Earlier quoted context omitted.

How do you know about the 'with ease' part?

Well the age sets an upper bound for the effort put into it, doesn't it?

Not really. I was much more focused and arguably a better coder at 18, albeit a somewhat less knowledgeable one.

At 26 I have twice the experience but only a third of the motivation and focus. When you're younger you do stuff just find out whether you can, when you're older you already know you could and decide not to do anything.

It's exceedingly rare I'll find something interesting enough that'll keep me coding for 15 hours straight, at 18 that was the norm on pretty much every free day - of which there are a lot more when you're younger and not already working as a software dev.

My money will always be on the 18 year olds.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#87

Post by jeffbee »

z3t4 wrote: post #80
bassdropvroom wrote: post #43

Earlier quoted context omitted.

> Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in progress now. It will…

Look for a company who's business model includes uptime, security and scalability. And is big enough to not outsource those parts. And in a mature market where customers can tell the difference.

Also look at their job ads. If they are looking to hire a devops to own their ci/cd pipeline, that means they don’t have one (and, with that approach, will never have one).

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#88

Post by fistynuts »

kentonv wrote: post #19
luxuryballs wrote: post #13

Does this kind of thing impact node apps?

Not really. While the bug technically exists on Node, generally people do not use Node to run untrusted JS/Wasm code. Node isn't designed to be a sandbox.

People install random Node modules every day.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#89

Post by simscitizen »

saurik wrote: post #38
kentonv wrote: post #35

Earlier quoted context omitted.

> which patched the bug in the V8 code last week This does not appear to be true. AFAICT the first patch was merged today: https://chromium-review.googlesource.com/c/v8/v8/+/2820971 (It was then rapidly cherry-picked into release branches, after which our automation picked it up.) > I am curious about this because I want to better understand the mitigations in place by a service such as Cloudflare, as I am interested…

Thanks; FWIW, I'd definitely read that blog post, and watched the talk you gave a while back (paying careful attention to the Q&A, etc. ;P). (I had had a back/forth with you a while back, actually, surrounding how you limit the memory usage of workers, and in the end sam still unsure what strategy you went with.) https://news.ycombinator.com/item?id=23975152 BTW: if there is any hope you can help put me in touch with…

I would be interested to hear a response to your V8 memory limit question. Years before Cloudflare workers we isolated Parse Cloud Code workers in exactly the same way, at least at the beginning (multiple V8 isolates in the same process). One of the big issues was not really being able to set a true memory limit in V8. There was a flag, but it was pretty advisory--there were still codepaths that just tried to GC multiple times and then abort if not enough space was freed up. Not ideal when running multiple tenants in the same process.

Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest

#90

Post by heljara »

To add some further context that isn't written here, the exploit developer here has been tinkering around with v8 for a while. Last year he published a vulnerable VM to HackTheBox (a CTF platform) called RopeTwo[1], where the initial entry point looked extremely similar to this. Its largely regarded as one of the most difficult challenges to solve to date.

1. https://www.hackthebox.eu/home/machines/profile/260

Post reply on HN