Re:JIT-Less V8
by gok on Wednesday March 13, 2019 @12:26PM
(#19380273)
JIT-less should really be the default on the web. The security implications of RWX memory are just so bad, and the amount of time that an exotic JIT meaningfully improves behavior of real world web browsing (as opposed to JavaScript benchmarks) is limited. For the rare web app where a JIT is critical, a simple "Do you really trust this web page to perform a lot of computation?" dialog would mitigate a lot of zero-click/one-click attacks.
[ Parent
| on HN ]
V8 already employs W^X, i.e. memory pages allocated for V8's heap are either writable or executable, but not both at the same time.
Re:JIT-Less V8
by MikeHolman on Wednesday March 13, 2019 @03:45PM
(#19382889)
By allowing JIT at all, a small ROP chain can call VirtualProtect to make a larger payload executable.
Sure you can do everything with ROP, but it is less convenient (and Intel CET might eventually make ROP attacks actually hard).
Well, except for WebAssembly. But even then, it's still fundamentally possible to hijack control of whatever changes the pages from RW to RX.
> The security implications of RWX memory are just so bad
Such as? Any practical examples here?
Code executions is code execution. RWX just lets you execute faster code, it doesn't give you any privileges or permissions you didn't otherwise already have.
Which didn't need RWX by using ROP chains instead...?
The security vulnerability there was that the process had the ability to invoke shell at all, not how they got to invoking shell. In-process sandboxing isn't a thing anymore, spectre proved that. In that context what risk does RWX actually pose?
Anyone know how common attacks that take advantage of the JIT technology actually are?
It's been used consistently to get initial code execution on the PlayStation 4, iOS (for attacks involving just following a web link), and probably used pretty consistently other nation-state attacks but I have no real data to back this up.
The Pegasus spyware for instance utilized a JIT attack in JavaScriptCore in Safari for the initial stage.