research-article

Open access

A Framework for Automatic Exploit Generation for JIT Compilers

Authors:

Saumya DebrayAuthors Info & Claims

Checkmate '21: Proceedings of the 2021 Research on offensive and defensive techniques in the Context of Man At The End (MATE) Attacks

Pages 11 - 19

https://doi.org/10.1145/3465413.3488573

Published: 15 November 2021 Publication History

Abstract

This paper proposes a framework for automatic exploit generation in JIT compilers, focusing in particular on heap corruption vulnerabilities triggered by dynamic code, i.e., code generated at runtime by the JIT compiler. The purpose is to help assess the severity of vulnerabilities and thereby assist with vulnerability triage. The framework consists of two components: the first extracts high-level representations of exploitation primitives from existing exploits, and the second uses the primitives so extracted to construct exploits for new bugs. We are currently building a prototype implementation of the framework focusing on JavaScript JIT compilers. To the best of our knowledge, this is the first proposal to consider automatic exploit generation for code generated dynamically by JIT compilers.

Supplementary Material

MP4 File (check045.mp4)

The video begins by comparing the difference between automatic exploit generation for traditional bugs and JIT compiler bugs. Then we explained with an example how our approach works - deriving an exploit from a given proof-of-concept.

Download
46.97 MB

References

[1]

Michalis Athanasakis, Elias Athanasopoulos, Michalis Polychronakis, Georgios Portokalidis, and Sotiris Ioannidis. 2015. The Devil is in the Constants: Bypassing Defenses in Browser JIT Engines.

[2]

Thanassis Avgerinos, Sang Kil Cha, Brent Lim, and David Brumley. 2011. AEG: Automatic Exploit Generation. In Network and Distributed System Security Symposium. Internet Society.

[3]

bugs.chromium.org. 2017. Issue 716044: V8: OOB write in Array.prototype.map builtin. https://bugs.chromium.org/p/chromium/issues/detail?id=716044

[4]

S. K. Cha, T. Avgerinos, A. Rebert, and D. Brumley. 2012. Unleashing Mayhem on Binary Code. In 2012 IEEE Symposium on Security and Privacy. 380--394. https://doi.org/10.1109/SP.2012.31

Digital Library

[5]

Weiteng Chen, Xiaochen Zou, Guoren Li, and Zhiyun Qian. 2020. {KOOBE}: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities. In 29th {USENIX} Security Symposium ({USENIX} Security 20). 1093--1110.

Digital Library

[6]

ctf.pediy.com. 2019. XiaoHuHuanXiang. https://ctf.pediy.com/game-season_fight-129.htm

[7]

ctftime.org. 2019. oob-v8. https://ctftime.org/task/8393

[8]

cve.mitre.org. 2019. CVE-2019--5782. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5782

[9]

Moritz Eckert, Antonio Bianchi, Ruoyu Wang, Yan Shoshitaishvili, Christopher Kruegel, and Giovanni Vigna. 2018. HeapHopper: Bringing Bounded Model Checking to Heap Implementation Security. In 27th USENIX Security Symposium (USENIX Security 18). USENIX Association, Baltimore, MD, 99--116. https://www.usenix.org/conference/usenixsecurity18/presentation/eckert

Digital Library

[10]

Tommaso Frassetto, David Gens, Christopher Liebchen, and Ahmad-Reza Sadeghi. 2017. JITGuard: Hardening Just-in-Time Compilers with SGX. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (Dallas, Texas, USA) (CCS '17). Association for Computing Machinery, New York, NY, USA, 2405--2419. https://doi.org/10.1145/3133956.3134037

Digital Library

[11]

Behrad Garmany, Martin Stoffel, Robert Gawlik, Philipp Koppe, Tim Blazytko, and Thorsten Holz. 2018. Towards Automated Generation of Exploitation Primitives for Web Browsers. In Proceedings of the 34th Annual Computer Security Applications Conference (San Juan, PR, USA) (ACSAC '18). Association for Computing Machinery, New York, NY, USA, 300--312. https://doi.org/10.1145/3274694.3274723

Digital Library

[12]

Robert Gawlik and Thorsten Holz. 2018. SoK: Make JIT-Spray Great Again. In 12th USENIX Workshop on Offensive Technologies (WOOT 18). USENIX Association, Baltimore, MD. https://www.usenix.org/conference/woot18/presentation/gawlik

Digital Library

[13]

Sean Heelan and D. Kroening. 2009. MSc Computer Science Dissertation Automatic Generation of Control Flow Hijacking Exploits for Software Vulnerabilities.

[14]

Sean Heelan, Tom Melham, and Daniel Kroening. 2019. Gollum: Modular and Greybox Exploit Generation for Heap Overflows in Interpreters. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (London, United Kingdom) (CCS '19). Association for Computing Machinery, New York, NY, USA, 1689--1706. https://doi.org/10.1145/3319535.3354224

Digital Library

[15]

Hong Hu, Zheng Leong Chua, Sendroiu Adrian, Prateek Saxena, and Zhenkai Liang. 2015. Automatic Generation of Data-Oriented Exploits. In 24th USENIX Security Symposium (USENIX Security 15). USENIX Association, Washington, D.C., 177--192. https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/hu

Digital Library

[16]

Shih-Kun Huang, Min-Hsiang Huang, Po-Yen Huang, Chung-Wei Lai, Han-Lin Lu, and Wai-Meng Leong. 2012. CRAX: Software Crash Analysis for Automatic Exploit Generation by Modeling Attacks as Symbolic Continuations. In Proceedings of the 2012 IEEE Sixth International Conference on Software Security and Reliability (SERE '12). IEEE Computer Society, USA, 78--87. https://doi.org/10.1109/SERE.2012.20

Digital Library

[17]

Benjamin Kollenda, Enes Göktacs, Tim Blazytko, Philipp Koppe, Robert Gawlik, Radhesh Krishnan Konoth, Cristiano Giuffrida, Herbert Bos, and Thorsten Holz. 2017. Towards automated discovery of crash-resistant primitives in binary executables. In 2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). IEEE, 189--200.

[18]

Giorgi Maisuradze, Michael Backes, and Christian Rossow. 2016. What Cannot Be Read, Cannot Be Leveraged? Revisiting Assumptions of JIT-ROP Defenses. In 25th USENIX Security Symposium (USENIX Security 16). USENIX Association, Austin, TX, 139--156. https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/maisuradze

Digital Library

[19]

Taemin Park, Karel Dhondt, David Gens, Yeoul Na, Stijn Volckaert, and Michael Franz. 2020. NoJITsu: Locking Down JavaScript Engines. https://doi.org/10.14722/ndss.2020.24262

[20]

Dusan Repel, Johannes Kinder, and Lorenzo Cavallaro. 2017. Modular Synthesis of Heap Exploits. In Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security (Dallas, Texas, USA) (PLAS '17). Association for Computing Machinery, New York, NY, USA, 25--35. https://doi.org/10.1145/3139337.3139346

Digital Library

[21]

Chengyu Song, Chao Zhang, Tielei Wang, Wenke Lee, and David Melski. 2015. Exploiting and Protecting Dynamic Code Generation. In NDSS.

[22]

v8.dev. 2021. TurboFan. https://v8.dev/docs/turbofan

[23]

Minghua Wang, Purui Su, qi li, Lingyun Ying, Yi Yang, and Dengguo Feng. 2013. Automatic Polymorphic Exploit Generation for Software Vulnerabilities, Vol. 127. 216--233. https://doi.org/10.1007/978-3-319-04283-1_14

[24]

Yan Wang, Chao Zhang, Xiaobo Xiang, Zixuan Zhao, Wenjie Li, Xiaorui Gong, Bingchang Liu, Kaixiang Chen, and Wei Zou. 2018. Revery: From Proof-of-Concept to Exploitable. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (Toronto, Canada) (CCS '18). Association for Computing Machinery, New York, NY, USA, 1914--1927. https://doi.org/10.1145/3243734.3243847

Digital Library

[25]

Jan Werner, George Baltas, Rob Dallara, Nathan Otterness, Kevin Z. Snow, Fabian Monrose, and Michalis Polychronakis. 2016. No-Execute-After-Read: Preventing Code Disclosure in Commodity Software. In Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security (Xi'an, China) (ASIA CCS '16). Association for Computing Machinery, New York, NY, USA, 35--46. https://doi.org/10.1145/2897845.2897891

Digital Library

[26]

Wei Wu, Yueqi Chen, Xinyu Xing, and Wei Zou. 2019. {KEPLER}: Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities. In 28th {USENIX} Security Symposium ({USENIX} Security 19). 1187--1204.

Digital Library

[27]

Wei Wu, Yueqi Chen, Jun Xu, Xinyu Xing, Xiaorui Gong, and Wei Zou. 2018. {FUZE}: Towards facilitating exploit generation for kernel use-after-free vulnerabilities. In 27th {USENIX} Security Symposium ({USENIX} Security 18). 781--797.

Digital Library

[28]

Insu Yun, Dhaval Kapil, and Taesoo Kim. 2020. Automatic Techniques to Systematically Discover New Heap Exploitation Primitives. In 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, 1111--1128. https://www.usenix.org/conference/usenixsecurity20/presentation/yun

Digital Library

[29]

Y. Zhang, T. Liu, Z. Wang, Q. Ruan, and B. Fang. 2019. AutoDE: Automated Vulnerability Discovery and Exploitation. In 2019 IEEE Fourth International Conference on Data Science in Cyberspace (DSC). 46--53. https://doi.org/10.1109/DSC.2019.00016

[30]

Zixuan Zhao, Yan Wang, and Xiaorui Gong. 2020. HAEPG: An Automatic Multi-hop Exploitation Generation Framework. 89--109. https://doi.org/10.1007/978-3-030-52683-2_5

Cited By

Kang MXu YLi SGjomemo RHou JVenkatakrishnan VCao Y(2023)Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability2023 IEEE Symposium on Security and Privacy (SP)10.1109/SP46215.2023.10179352(1059-1076)Online publication date: May-2023
https://doi.org/10.1109/SP46215.2023.10179352

Index Terms

A Framework for Automatic Exploit Generation for JIT Compilers
1. Security and privacy
  1. Software and application security
    1. Software security engineering
  2. Systems security
    1. Browser security

Recommendations

Automated bug localization in JIT compilers
VEE 2021: Proceedings of the 17th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments

Many widely-deployed modern programming systems use just-in-time (JIT) compilers to improve performance. The size and complexity of JIT-based systems, combined with the dynamic nature of JIT-compiler optimizations, make it challenging to locate and fix ...
Surgical precision JIT compilers
PLDI '14: Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation

Just-in-time (JIT) compilation of running programs provides more optimization opportunities than offline compilation. Modern JIT compilers, such as those in virtual machines like Oracle's HotSpot for Java or Google's V8 for JavaScript, rely on dynamic ...
Surgical precision JIT compilers
PLDI '14

Just-in-time (JIT) compilation of running programs provides more optimization opportunities than offline compilation. Modern JIT compilers, such as those in virtual machines like Oracle's HotSpot for Java or Google's V8 for JavaScript, rely on dynamic ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

Checkmate '21: Proceedings of the 2021 Research on offensive and defensive techniques in the Context of Man At The End (MATE) Attacks

November 2021

76 pages

ISBN:9781450385527

DOI:10.1145/3465413

General Chair:
Christophe Hauser
Information Sciences Institute, University of Southern California, USA
,
Program Chairs:
Yonghwi Kwon
University of Virginia, USA
,
Sebastian Banescu
Technical University of Munich, Germany

Copyright © 2021 Owner/Author.

This work is licensed under a Creative Commons Attribution International 4.0 License.

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 15 November 2021

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

National Science Foundation

Conference

CCS '21

Sponsor:

SIGSAC

CCS '21: 2021 ACM SIGSAC Conference on Computer and Communications Security

November 19, 2021

Virtual Event, Republic of Korea

Upcoming Conference

CCS '25

Sponsor:
sigsac

ACM SIGSAC Conference on Computer and Communications Security

October 13 - 17, 2025

Taipei , Taiwan

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

1
Total Citations
View Citations
889
Total Downloads

Downloads (Last 12 months)442
Downloads (Last 6 weeks)285

Reflects downloads up to 06 Jan 2025

Other Metrics

View Author Metrics

Citations

Cited By

Kang MXu YLi SGjomemo RHou JVenkatakrishnan VCao Y(2023)Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability2023 IEEE Symposium on Security and Privacy (SP)10.1109/SP46215.2023.10179352(1059-1076)Online publication date: May-2023
https://doi.org/10.1109/SP46215.2023.10179352

View Options

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

Media

Figures

Other

Tables

View Table of Contents