Skip to content

Instantly share code, notes, and snippets.

@MaxBWMinRTT
MaxBWMinRTT / writeup.md
Last active August 27, 2024 04:59
Some quick notes about the CVE-2023-3079(V8 type confusion), no PoC yet.

Some quick notes about the CVE-2023-3079(V8 type confusion), no PoC yet.

Official patch: https://chromium-review.googlesource.com/c/v8/v8/+/4584248

image

Patch come from KeyedStoreIC::StoreElementHandler(), it returns fast path code(Turbofan builtin) for keyed store depends on "receiver_map" and "store_mode". Based on the content of this function is all about element STORE, I personally believe that this is an OOB writes vulnerability.

If we divide the PoC exploration into two parts based on this func, they are: