CVE-2024-9602 - Type Confusion in V8 Allows Remote Out-of-Bounds Write in Google Chrome (Exploit Explained)

A serious security bug, tracked as CVE-2024-9602, was discovered and fixed in Google Chrome, specifically in its V8 JavaScript engine, before version 129..6668.100. This vulnerability carries a High security rating because it allows a remote attacker to perform an out-of-bounds memory write just by luring a victim to visit a specially crafted HTML page. Out-of-bounds writes can crash the browser or, even worse, let an attacker run code of their choosing on the victim's machine.

In this long read, we’ll break down the bug, show a code snippet that illustrates the bug’s mechanics, and link to original sources for more info.

What Is V8?

V8 is the JavaScript engine at the heart of Chrome and other Chromium-based browsers. It compiles JavaScript to native machine code for speed.

What Is Type Confusion?

Type confusion happens when a piece of code wrongly assumes an object is of a certain type, but it's actually of another. This can lead to code treating data incorrectly, potentially causing memory corruption.

In the context of V8, this means JavaScript code can trick the engine into treating memory with one structure as if it’s another, such as making something look like an object when it’s really just a number, or vice versa.

CVE-2024-9602 in a Nutshell

In CVE-2024-9602, an attacker can craft JavaScript that leverages a type confusion bug within V8, ultimately leading to an out-of-bounds write—writing data to memory that the program isn’t supposed to access. This can crash the browser or even let bad actors run malicious code on your system.

The Exploit: Code Snippet

*Disclaimer: Below is a proof-of-concept for educational purposes only. Running exploits is illegal if you don't own the system.*

// Simplified example structure (not the actual exploit!)
// This snippet is inspired by past V8 type confusion bugs.

let arr = [1.1, 2.2];
let obj = {a: 1};
let float_array = [1.1, 2.2, 3.3];

function triggerTypeConfusion(obj_input) {
    // Some complex process tricks the JIT engine into believing arr is a Float64Array.
    // The engine then proceeds to treat 'arr' memory as floating points, but we sneak in an object reference:
    arr[] = obj_input;

    // Later, the engine writes to out-of-bounds memory, thinking it’s still safe.
    for (let i = ; i < 100; i++) {
        arr[i] = 13.37; // out-of-bounds write can happen here
    }
}

// Crafted input triggers confusion
triggerTypeConfusion(obj);

// At this point, memory corruption could let an attacker control what code is executed!

Note: The actual exploit involves much more convoluted steps, often involving inline caches and manipulating object shapes, but this demonstrates the general pattern: confound V8’s optimizer with unexpected input so it makes false assumptions.

The malicious JavaScript on the page starts executing.

2. JavaScript triggers type confusion inside V8 by carefully arranging the data and calling functions in a way that tricks the JIT compiler.

3. Attacker gets to write to arbitrary memory outside normal array/object boundaries.

4. Follow-up exploits may leverage the memory corruption for further exploitation, such as executing shellcode.

Enable automatic updates for Chrome and other Chromium-based browsers.

You can read the fix and technical details (and learn how the V8 team handled the issue) in the Chromium Bugs Tracker and V8 source diffs (if public).

References and Further Reading

- Chromium Security Advisory (CVE-2024-9602)
- NVD – CVE-2024-9602 detail
- V8 Type Confusion — Learn What That Means
- How Type Confusion In V8 Works (Project Zero)

Conclusion

CVE-2024-9602 is a reminder that even the most advanced browsers aren’t immune from memory corruption bugs. Type confusion issues in high-performance engines like V8 are dangerous and often targeted by attackers because they enable remote code execution with just a browser visit.

Timeline

Published on: 10/08/2024 23:15:12 UTC
Last modified on: 10/10/2024 12:51:56 UTC