鐧界櫆椋庢棭鏈熸湁浠�涔堢棁鐘? http://m.39.net/pf/a_6320392.html
前言
本篇主要是对zer0con上chromeexploitation议题v8部分的解读。
这个漏洞发生在SimplifiedLoweringphase的VisitSpeculativeIntegerAdditiveOp函数中，该函数是用来处理SpeculativeSafeIntegerAdd/SpeculativeSafeIntegerSubtract节点，对其重新计算类型并将其转化或者降级到更底层的IR。这个函数非常有趣，据我所知它已经出了三个可以RCE的漏洞了
Simplifiedlowingphase和RootCause
propagatingtruncations:反向数据流分析，传播truncation，并设置restriction_typeretype:正向数据流分析，重新计算类型，并设置representation。lower:降级(lower)节点或者插入转换(conversion)节点重要的数据结构和函数NodeInfo，记录数据流分析中节点的各种类型信息，主要包括truncation(指明该节点在使用的时候的截断信息)，restriction_type(在truncation传播阶段设置它的值，用于在retype的时候设置feedback_type)，feedback_type（用于在Retypephase重新计算type信息），representation（节点retype完成之后最终的表示类型，可以用于指明应该如何lower到更具体的节点，是否需要Convert）等。//Informationforeachnodetrackedduringthefixpoint.classNodeInfofinal{public://Addsnewusetothenode.Returnstrueifsomethinghaschanged//andthenodehastoberequeued.boolAddUse(UseInfoinfo){Truncationold_truncation=truncation_;truncation_=Truncation::Generalize(truncation_,info.truncation());returntruncation_!=old_truncation;}voidset_queued(){state_=kQueued;}voidset_visited(){state_=kVisited;}voidset_pushed(){state_=kPushed;}voidreset_state(){state_=kUnvisited;}boolvisited()const{returnstate_==kVisited;}boolqueued()const{returnstate_==kQueued;}boolpushed()const{returnstate_==kPushed;}boolunvisited()const{returnstate_==kUnvisited;}Truncationtruncation()const{returntruncation_;}voidset_output(MachineRepresentationoutput){representation_=output;}MachineRepresentationrepresentation()const{returnrepresentation_;}//Helpersforfeedbacktyping.voidset_feedback_type(Typetype){feedback_type_=type;}Typefeedback_type()const{returnfeedback_type_;}voidset_weakened(){weakened_=true;}boolweakened()const{returnweakened_;}voidset_restriction_type(Typetype){restriction_type_=type;}Typerestriction_type()const{returnrestriction_type_;}private:enumState:uint8_t{kUnvisited,kPushed,kVisited,kQueued};Statestate_=kUnvisited;MachineRepresentationrepresentation_=MachineRepresentation::kNone;//Outputrepresentation.Truncationtruncation_=Truncation::None();//Informationaboutuses.Typerestriction_type_=Type::Any();Typefeedback_type_;boolweakened_=false;};ProcessInput这是一个模板函数，根据不同的phase调用不同的实现，对于truncationpropagatephase，它将直接调用EnqueueInput。
templatevoidRepresentationSelector::ProcessInputPROPAGATE(Node*node,intindex,UseInfouse){DCHECK_IMPLIES(use.type_check()!=TypeCheckKind::kNone,!node-op()-HasProperty(Operator::kNoDeopt)node-op()-EffectInputCount()0);EnqueueInputPROPAGATE(node,index,use);}templatevoidRepresentationSelector::ProcessInputRETYPE(Node*node,intindex,UseInfouse){DCHECK_IMPLIES(use.type_check()!=TypeCheckKind::kNone,!node-op()-HasProperty(Operator::kNoDeopt)node-op()-EffectInputCount()0);}templatevoidRepresentationSelector::ProcessInputLOWER(Node*node,intindex,UseInfouse){DCHECK_IMPLIES(use.type_check()!=TypeCheckKind::kNone,!node-op()-HasProperty(Operator::kNoDeopt)node-op()-EffectInputCount()0);ConvertInput(node,index,use);}...//Convertsinput{index}of{node}accordingtogivenUseInfo{use},//assumingthetypeoftheinputis{input_type}.If{input_type}isnull,//ittakestheinputfromtheinputnode{TypeOf(node-InputAt(index))}.voidConvertInput(Node*node,intindex,UseInfouse,Typeinput_type=Type::Invalid()){//Inthechangephase,insertachangebeforetheuseifnecessary.if(use.representation()==MachineRepresentation::kNone)return;//Noinputrequirementontheuse.Node*input=node-InputAt(index);DCHECK_NOT_NULL(input);NodeInfo*input_info=GetInfo(input);MachineRepresentationinput_rep=input_info-representation();if(input_rep!=use.representation()
use.type_check()!=TypeCheckKind::kNone){//Outputrepresentationdoesntmatchusage.TRACE("change:#%d:%s(
%d#%d:%s)",node-id(),node-op()-mnemonic(),index,input-id(),input-op()-mnemonic());TRACE("from%sto%s:%s\n",MachineReprToString(input_info-representation()),MachineReprToString(use.representation()),use.truncation().description());if(input_type.IsInvalid()){input_type=TypeOf(input);}Node*n=changer_-GetRepresentationFor(input,input_rep,input_type,node,use);node-ReplaceInput(index,n);}}EnqueueInput这个函数先从全局数组里取出node的指定index的输入节点对应的NodeInfo信息，然后调用AddUse来更新info的truncation_字段，从而将truncation反向传播。//Enqueue{use_node}s{index}inputifthe{use_info}containsnewinformation//forthatinputnode.templatevoidRepresentationSelector::EnqueueInputPROPAGATE(Node*use_node,intindex,UseInfouse_info){Node*node=use_node-InputAt(index);NodeInfo*info=GetInfo(node);#ifdefDEBUG//Checkmonotonicityofinputrequirements.node_input_use_infos_[use_node-id()].SetAndCheckInput(use_node,index,use_info);#endif//DEBUGif(info-unvisited()){info-AddUse(use_info);TRACE("initial#%i:%s\n",node-id(),info-truncation().description());return;}TRACE("queue#%i?:%s\n",node-id(),info-truncation().description());if(info-AddUse(use_info)){//Newusageinformationforthenodeisavailable.if(!info-queued()){DCHECK(info-visited());revisit_queue_.push(node);info-set_queued();TRACE("added:%s\n",info-truncation().description());}else{TRACE("inqueue:%s\n",info-truncation().description());}}}boolAddUse(UseInfoinfo){Truncationold_truncation=truncation_;truncation_=Truncation::Generalize(truncation_,info.truncation());returntruncation_!=old_truncation;}SetOutput这个函数也是模板函数，根据不同phase调用不同的偏特化实现对于truncationpropagatephase，它将更新节点对应的nodeinfo的restriction_type_，并用于后续的retypephase上。对于retypephase，它将更新节点的representation表示。
templatevoidRepresentationSelector::SetOutputPROPAGATE(Node*node,MachineRepresentationrepresentation,Typerestriction_type){NodeInfo*constinfo=GetInfo(node);info-set_restriction_type(restriction_type);}templatevoidRepresentationSelector::SetOutputRETYPE(Node*node,MachineRepresentationrepresentation,Typerestriction_type){NodeInfo*constinfo=GetInfo(node);DCHECK(restriction_type.Is(info-restriction_type()));info-set_output(representation);}templatevoidRepresentationSelector::SetOutputLOWER(Node*node,MachineRepresentationrepresentation,Typerestriction_type){NodeInfo*constinfo=GetInfo(node);DCHECK_EQ(info-representation(),representation);DCHECK(restriction_type.Is(info-restriction_type()));USE(info);}
PoC
Issue
