CVE-2021-30632 PoC — Google Chrome 缓冲区错误漏洞

Description

PoC CVE-2021-30632 - Out of bounds write in V8

介绍

# PoC-CVE-2021-30632
PoC CVE-2021-30632 - Out of bounds write in V8


Tested against Samsung Internet Browser v15.0.2.47, which does not yet have Google's patch.

This bug is caused by the fact that global property "stores" for existing values with unstable maps are lacking a
stability code dependency in the affected versions.
It is exploitable because global property "loads" benefit from "CheckMaps" removal when a stability code dependency
is in place for their value's map.
The recipe for explotaition involves transitioning from an array of PACKED_SMI elements with a stable map to an array of
PACKED_DOUBLE elements and have multiple JITted functions that deal with each kind of array.
Type confusions between PACKED_SMI and PACKED_DOUBLE elements => Out of bounds R/W.

文件快照

备注