CVE-2018-17463 PoC — Google Chrome V8 输入验证错误漏洞

Source

https://github.com/kdmarti2/CVE-2018-17463

Associated Vulnerability

Title:Google Chrome V8 输入验证错误漏洞 (CVE-2018-17463)
Description:Google Chrome是美国谷歌（Google）公司开发的一款Web浏览器。V8是其中的一套开源JavaScript引擎。 Google Chrome 70.0.3538.67之前版本中的V8存在安全漏洞。远程攻击者可借助特制的HTML页面利用该漏洞在沙盒内执行任意代码。

Description

Completed a working exploit for CVE-2018-17463 for fun.

Readme

# CVE-2018-17463
Completed a working exploit for CVE-2018-17463 for fun.

The original writeup that I found on this bug was here http://phrack.org/papers/jit_exploitation.html. I just really wanted to change this arb r/w into a fully working exploit.

Also I learned the JIT spray technique from the following paper which is an interesting read.
```
@inproceedings{gawlik2018sok,
  title={Sok: Make jit-spray great again},
  author={Gawlik, Robert and Holz, Thorsten},
  booktitle={12th $\{$USENIX$\}$ Workshop on Offensive Technologies ($\{$WOOT$\}$ 18)},
  year={2018}
}
```
url: https://www.usenix.org/system/files/conference/woot18/woot18-paper-gawlik.pdf

File Snapshot


 [4.0K]  /data/pocs/05c89f0f9c82e1fdb196d1125a1fe4c8cf4808a0
├── [7.5K]  CVE-2018-17463.js
├── [6.8K]  exploit_working.PNG
└── [ 660]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!