Collection of V8 engine CVEs and resources

CVEs

• CVE-2018-17463: successful exploitation by following this tutorial.
• CVE-2024-0517: successful exploitation by following this blog, this blog and the PoC
• CVE-2023-4427: successful crash by following this blog.
• CVE-2021-30551: check this blog.
• CVE-2021-21225: check this blog.

Resources

Source code:

• Download pre-built V8: https://commondatastorage.googleapis.com/v8-asan/index.html?prefix=linux-debug/
• Download old chromium version: https://vikyd.github.io/download-chromium-history-version/#/
• Browse V8 source code online: https://source.chromium.org/chromium/chromium/src/+/main:v8

Series:

• An extremely comprehensive series of V8 exploit: https://jhalon.github.io/categories.html
• Another V8 exploit series: https://www.madstacks.dev/categories/v8-series/
• A tour of V8: https://jayconrod.com/posts/51/a-tour-of-v8
• Explaining V8 with comics: https://mrale.ph/v8/resources.html

Internals:

• Almost everything:
  • https://github.com/danbev/learning-v8
  • https://github.com/pranayga/expl0ring_V8?tab=readme-ov-file
• Hidden classes and inline caching:
  • Google I/O 2009: https://www.youtube.com/watch?v=FrufJFBSoQY
  • Good visualization: https://mathiasbynens.be/notes/shapes-ics
  • Hidden classes from V8 docs: https://v8.dev/docs/hidden-classes
• Memory model:
  • Arrays and element kinds: https://www.youtube.com/watch?v=m9cTaYI95Zc
  • Pointer compression: https://v8.dev/blog/pointer-compression
• Speculative Optimization: https://ponyfoo.com/articles/an-introduction-to-speculative-optimization-in-v8#speculative-optimization
  • Bytecode: https://medium.com/dailyjs/understanding-v8s-bytecode-317d46c94775
  • Sparklug: https://v8.dev/blog/sparkplug
  • Maglev: https://docs.google.com/document/d/13CwgSL4yawxuYg3iNlM-4ZPCB8RgJya6b8H_E2F-Aek/edit#heading=h.djws22xta9wz
  • TurboFan:
    • Sea of Nodes: https://darksi.de/d.sea-of-nodes/
    • Optimization phases: https://doar-e.github.io/blog/2019/01/28/introduction-to-turbofan/
• Ubercage sandbox: https://docs.google.com/document/d/1FM4fQmIhEqPG8uGp5o9A-mnPB5BOeScZYpkHjo0KKA8/edit#heading=h.xzptrog8pyxf
• Heap sandbox escapes:
  • https://mem2019.github.io/jekyll/update/2022/02/06/DiceCTF-Memory-Hole.html
  • https://anvbis.au/posts/exploring-historical-v8-heap-sandbox-escapes-i/

Chromium:

• Multi-process architecture: https://www.chromium.org/developers/design-documents/multi-process-architecture/
• Sandboxing: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md
• Blink (rendering engine): https://docs.google.com/document/u/0/d/1aitSOucL0VHZa9Z2vbRJSyAIsAz24kX8LFByQ5xQnUg/mobilebasic#h.akojgy1ki8zd

Analysis:

• CVE-2024-0517 (new):
  • https://bnovkebin.github.io/blog/CVE-2024-0517/
  • https://www.vicarius.io/vsociety/posts/out-of-bound-write-in-v8-javascript-engine-cve-2024-0517