JIT Spraying Never Dies

Recommendations

Info

Abstract • Many scripting languages, such as JavaScript and ActionScript, use Just-In-Time (JIT) compilation to improve the script execution performance. However, under some circumstances, the legit JIT mechanism can be leveraged by the exploit to bypass memory protection and mitigation such as ASLR and DEP. Such exploitation technique was first introduced as "JIT Spraying" in 2010. The idea is to use the constant numeric value in high-level script language to generate the desired JITed code at predictable locations. With the JIT spraying as a reliable exploitation technique seeing its popularity, vendors started to revisit the JIT engine implementation. Since then, mitigation countermeasures, such as randomizing the JIT code page allocation and mutating JITed code generation, have been employed to prevent JIT spraying. Particularly, MS WARP Shader JIT engine, which we will exploit in this talk, has security mechanisms such as Shader complexity, JIT cache size limit, separation between the constant data and code. As a result, the JIT spraying technique became less effective in most exploitation scenarios. Nevertheless, JIT Spraying technique has never died, even in the most secure Windows 10 era. In this talk, we will present a completely different JIT spraying exploitation technique (based on MS WARP JIT) to bypass control flow guard (CFG) in the context of browser in a generic way. This presentation provides details on how to circumvent the MS WARP JIT restrictions and achieve reliable CFG bypass. At the end, a live demo will be given to demonstrate bypassing CFG on IE11 and Edge of Windows 10.
About Speakers • Bing Sun – Bing Sun is a senior information security researcher, and now he is leading the IPS security research team of Intel Security Group (formerly McAfee). He has extensive experiences in operating system kernel and information security technique R&D, with especially deep diving in advanced vulnerability exploitation and detection, Rootkits detection, firmware security and virtualization technology. Moreover, Bing is also a regular speaker at international security conference, such as XCon, Black Hat and CanSecWest. • Chong Xu – Chong received his Ph.D. degree in networking and security from Duke University. His current focus includes research and innovation on intrusion and prevention techniques as well as threat intelligence. He is a senior director of Intel Security IPS team, which leads Intel Security vulnerability research, malware and APT detection, and botnet detection and feeds security content and innovative protection solutions into Intel Security’s network IPS, host IPS, and sandbox products, as well as McAfee Global Threat Intelligence (GTI).
Page 1: JIT Spraying Never Dies - Bypass CF
Page 5 and 6: Background Knowledge • Direct3D &
Page 7 and 8: Software Rasterizer & WARP • Soft
Page 9 and 10: GLSL & HLSL • Shading Language -
Page 11 and 12: WebGL and Its Usage • WebGL (Web
Page 13 and 14: The Basic Principle of CFG • Abou
Page 15 and 16: Known CFG Bypass Methods • Call V
Page 17 and 18: The Security Assessment on WARP Sha
Page 19 and 20: Separation of Data and Code Data Co
Page 21 and 22: The Weakness of WARP Shader JIT Eng
Page 23 and 24: No CFG for JITed Code Data Code
Page 25 and 26: WARP Module Not Loaded Web page con
Page 27 and 28: The Solution to Challenge I & II
Page 29 and 30: The Solution to Challenge III • S
Page 31 and 32: The Solution to Challenge III (cont
Page 33 and 34: MS16-063 typedarray.subarray(ropsta
Page 35 and 36: CVE-2016-0193 (jmp) esi -> Fake vft
Page 37 and 38: The Possibility of Exploiting 64-bi
Page 39 and 40: Demo - MS16-063
Page 41 and 42: Extra Demo • Other 0day CFG/DEP B
Page 43 and 44: Demo - CFG/DEP Bypass 0day II Creat
Page 45 and 46: Q&A • You are welcomed to send qu

JIT Spraying Never Dies

Create successful ePaper yourself

Delete template?

Save as template?