Re:Exploiting the Math.expm1 typing bug in V8
by laurentl on Thursday January 03, 2019 @03:14AM
(#18813621)
> it might be an almost archetypical example of the "all bugs are security vulnerabilities" hypothesis
This article will be my new go-to example when someone handwaves a bug away with a complacent “it’ll never happen” and “it’s not that big of a deal”. Yes it will, and yes it is.
Re:Exploiting the Math.expm1 typing bug in V8
by wglb on Thursday January 03, 2019 @10:21AM
(#18815700)
Right, and it is right up there with https://www.blackhat.com/us-18/briefings/schedule/index.html, whose security value was unappreciated by some very smart folks.
Re:Exploiting the Math.expm1 typing bug in V8
by EE84M3i on Thursday January 03, 2019 @12:02PM
(#18816671)
Were you trying to link to a specific briefing? Your link just goes to the full schedule for me.
Re:Exploiting the Math.expm1 typing bug in V8
by wglb on Friday January 04, 2019 @08:15PM
(#18829238)
Yes, sorry about that
https://www.blackhat.com/us-18/briefings/schedule/index.html...
Re:Exploiting the Math.expm1 typing bug in V8
by diamondo25 on Thursday January 03, 2019 @01:42AM
(#18813348)
If they just didnt discard the OutOfBounds check, the V8 JS engine would be a lot safer...
Re:Exploiting the Math.expm1 typing bug in V8
by userbinator on Thursday January 03, 2019 @02:15AM
(#18813457)
...and probably a lot slower. Google loves to make claims about V8's performance, but not so much about security.
Re:Exploiting the Math.expm1 typing bug in V8
by tokyodude on Thursday January 03, 2019 @05:06AM
(#18814062)
certainly V8 tries to be correct and this bug will be fixed. Chromium's position is "security in depth". They know it's impossible to have zero bugs therefore the entire architure assumes there will be bugs and tries to prevent them from causing any harm. This is also why there are roughly 10x less code execution bugs in chrome vs other browsers. same number of bugs overall but most lead nowhere
Re:Exploiting the Math.expm1 typing bug in V8
by blattimwind on Thursday January 03, 2019 @06:45AM
(#18814427)
> Chromium's position is "security in depth".
Yet the exploit in WebSQL a few weeks ago gave RCE from a component directly reachable by page scripts.
Re:Exploiting the Math.expm1 typing bug in V8
by librarian42 on Saturday January 05, 2019 @09:36AM
(#18831813)
Technically that was an SQL injection attack. :)
But if you believe that this is an example of wanton abuse at Google, you can trade on that belief, and in a sense put your money where your mouth is, because this is a whole class of potential bugs, not just one bug; the same pattern will recur for other places where the v8 typer is wrong about the possible results of functions. Go do a sweep! If you find one, the value of the resulting bug might be pretty decent.