Hacker News Reader

Comment by petra303 | Hacker News Reader

Only a score of 8.8?

RCE inside sandbox, so requires chaining with another 0day.

What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?

It means it can execute arbitrary machine code in the sandbox.

I think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.

Seems to use OS-specific kernel syscall filtering facilities.

Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d...

Linux: https://chromium.googlesource.com/chromium/src/+/0e94f26e8/d...

great link, thanks

V8 also has its own sandbox, which I believe exists in that sandbox. I assume that's the one this exploit has RCE in, but its unclear.

https://chromium.googlesource.com/v8/v8.git/+/refs/heads/mai...

I would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.

Okay, and why is that more of a security risk than executing arbitrary JavaScript in the sandbox?

because with proper code exec you can trigger other bugs to escalate beyond the sandbox, whereas with JS you'd have to find a bug to escape from JS to native

can't get a proper ios/Android RCE with just JS code exec

It can do some things that JS can’t do, such as invalid pointer writes. But you are correct that this doesn’t automatically imply system access.

Because Javascript theoretically can't just access files on disk. Control over the render would let you do that, if not for the process level sandbox, which constraints things like file access, system, calls, etc.

But the process is still more capable than the VM. The process can talk to other processes via IPC, for example.

That's why you don't go from "javascript -> computer is taken over", instead you go from "javascript -> renderer control -> computer is taken over".

Among other things, JavaScript in the browser has no way to even express "kill PID 1234 on the user's machine" or "list the contents of `C:\Users\Documents` and upload all of the files" or "spawn cmd.exe on the user's machine". How would you even do these things if you could run any JavaScript in the browser? You can't.

However, chrome.exe itself does because it's a native application, as is the sandboxed JavaScript interpreter inside of chrome.exe.

(This is a very oversimplified explanation but I think this is the disconnect people are having)

> JavaScript in the browser has no way to even express ... "list the contents of `C:\Users\Documents` and upload all of the files"

this is besides the point, but javascript has the file system api.

anyways to your broad point, i dont think this is convincing. What's the difference between not having an api vs having an api that is disabled (e.g. the syscall exists but is filtered). Either way you are not taking the action. RCE in the sandbox is an important step in the bigger exploit chain, but not because you can express things in the traditional syscalls inside the sandbox.

Okay, but we're still talking about running machine code inside the sandbox, where that functionality is still not available.

The functionality is restricted, but the capability of expressing the intent at all exists.

> It means it can execute arbitrary machine code in the sandbox.

Well which is precisely why we have sandboxes.

To me "executing arbitrary code in the sandbox" is similar to "I don't give a flying fuck for it's what a sandbox is for".

More information is needed. As someone commented: this has to be paired with at least another exploit to make anything remotely useful.

A sandbox is a sandbox. We want to understand how "code running in a sandbox" is "actively exploited".

Memory isolation having one tab or account open on your bank and another on this page does not mean it could leak across the sandbox and steal bank account details but anything inside of your general page content can be lost

It means it can execute native code inside the sandbox, as opposed to Javascript. While still sandboxed, this lets it access some parts of the attack surface that JS would not have been able to, some of which may have other exploits that allow escaping the rest of the way.

Chrome runs webpages in individual sandbox processes with very low privileges, as a defense-in-depth strategy. It generally requires at least two exploits to actually affect a user--first, get RCE in a sandboxed process, then find a separate vulnerability that lets you escape the sandbox process entirely. For this bug to have actually been used in the wild, there was almost certainly a second bug as well.

what is online ad networks for $100, alex

I don't know why this is being downvoted. This is called malvertising and its one of the most significant vectors for exploiting a vulnerability like this. Its happened multiple times over the last two decades.

My read of Google's disclosure is that there is likely no known escape from the sandbox. I don't agree this would be reported this way just because "user action" like "using web browser" is required. Even if this individual CVE is correctly an 8.8 there would be a critical assessment of a known chain. The only reason there wouldn't be, would be if the other vulnerability is known to Google but has no patch yet.

This doesn't affect the score though, the reason there's 1.2 points less than the max is because there is a Required User Interaction. The user needs to visit a specific html page.

Even with the sandbox protection layer, the rest of the parameters are maxed out.

Reply on news.ycombinator.com