News for hackers. Stuff that matters.

A comment on Control-Flow Integrity in V8. Parent comment

Re:Control-Flow Integrity in V8 by hovav on Monday October 09, 2023 @04:00PM (#37824752)
A JIT is a machine for turning logic bugs into memory unsafety. Rewriting a JIT in Rust won't eliminate logic bugs and won't guarantee memory safety for the binary output of the JIT (as distinct from the JIT implementation itself).
[ Parent | on HN ]
Re:Control-Flow Integrity in V8 by infogulch on Monday October 09, 2023 @04:06PM (#37824822)
Agreed. But the way you put it makes me wonder how many memory safety vulns have been found in JIT implementations (not the machine code they output).
[ Parent | on HN ]
Re:Control-Flow Integrity in V8 by nextaccountic on Monday October 09, 2023 @05:25PM (#37825716)
Okay, but in this case software verification like with Coq or F* could help
[ Parent | on HN ]
Re:Control-Flow Integrity in V8 by hovav on Monday October 09, 2023 @06:43PM (#37826374)
Yes! See, e.g., Fraser Brown et al., "Towards a Verified Range Analysis for JavaScript JITs," in proc. PLDI 2020, https://www.cs.utexas.edu/~hovav/dist/vera.pdf
[ Parent | on HN ]