Google Chrome Zero Day CVE-2021-4102, Use after free in V8

Indeed. At one point this was a bigger deal, now it seems that this is the new normal.

Chrome bought a good decade or so of security for itself by leveraging sandboxing, but it seems that attackers have gotten their bearings, so here we are.

I'm curious though. 4102 is a v8 vulnerability. That shouldn't be sufficient to take over a computer. I wonder if there's another 0day for Windows/Linux that it's being paired with?

On the page they state:

> Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

I guess they will open up in the next few days.

This is one class of bugs that would not exist if javascript was banned.

Unlikely - JS engines do a lot of things that are inherently unsafe - pretty much anything related to garbage collection isn’t doable outside of unsafe{} blocks in rust, which as you might guess are unsafe.

I can’t speak for V8, but the majority of UaF in JSC have been due to GC bugs collecting objects early. Being in C++ isn’t relevant.

Many other bugs are in things that are doing absurd memory manipulation needed for execution speed of common primitives. The rust implementation of these would also necessarily be unsafe.

Probably not much. I remember seeing a comment from someone that works at cloudflare, saying that they could deploy changes within hours.

edit:

>Fortunately, we have an advantage here, in that we directly control the machines on which our system runs. We have automated almost our entire build and release process, so the moment a V8 patch is published, our systems automatically build a new release of the Workers Runtime and, after one-click sign-off from the necessary (human) reviewers, automatically push that release out to production.

>As a result, our patch gap is now under 24 hours. A patch published by V8's team in Munich during their work day will usually be in production before the end of our work day in the US.

https://blog.cloudflare.com/mitigating-spectre-and-other-sec...

Or anything running on NodeJS?

We patched when we were notified. And we have a pretty robust model around Workers that is meant to deal with this possibility.

Luckily, Google is removing that feature.

Or if you're using FireFox... Which is migrating code to Rust where this sort of issue can't happen.

Unless these actors have other ways to convince you to go to their landing page :o)