A significant security flaw, designated as CVE-2024-5830, has been detected in the V8 JavaScript engine used by Chrome. First flagged as bug 342456991 in May 2024, this issue involves a type confusion vulnerability.
This flaw allows attackers to run unauthorized code within Chrome’s rendering environment merely by luring a user to a malicious site. The problem lies in the way the V8 engine processes object maps and transitions. These maps, or hidden classes, are critical for defining object memory layouts and optimizing property access.
A defect in the map transition mechanism can cause improper handling of object properties, potentially updating an obsolete map to a dictionary map. This inconsistency can lead to out-of-bounds access, which can be exploited.
Today, security expert Man Yue Mo from the GitHub Security Lab released a detailed analysis of the issue. The vulnerability is triggered when V8 tries to update the map of an object that has become deprecated due to changes in its properties’ types. In some cases, this update incorrectly converts the object into a dictionary type instead of a fast type, leading to type confusion. This allows an attacker to manipulate the object’s properties and layout, causing potential corruption of the dictionary object.
Mo demonstrated that this corruption could be used to craft a fake object in the V8 heap. By triggering a function that attempts to convert the corrupted dictionary object back into a fast type, the fake object can be accessed, resulting in out-of-bounds access to its elements. This vulnerability allows for arbitrary read and write operations within the V8 heap by manipulating heap memory layout and predicting object addresses.
Although modern V8 versions use a “heap sandbox” to isolate the JavaScript heap from other memory areas in the browser, making exploitation more difficult, Mo discovered a method to bypass this isolation. By corrupting API objects that interface between V8 and Blink (Chrome’s rendering engine), Mo was able to induce type confusion in Blink objects. Specifically, by misinterpreting a DOMRect object as a DOMTypedArray, Mo could overwrite the typed array’s backing store pointer, granting arbitrary read and write access to Chrome’s renderer process memory beyond the V8 sandbox.
With this access, attackers could then use established techniques to locate and corrupt function pointers or JIT-compiled code, enabling execution of arbitrary native code.
Google addressed this vulnerability with a patch in late July 2024, and the researcher commended Google for their swift and effective response.
This vulnerability highlights significant security risks and innovative evasion techniques, emphasizing the ongoing need for vigilance and improvements in browser security.
