You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<str<strong>on</strong>g>Analysis</str<strong>on</strong>g> <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> <str<strong>on</strong>g>Pegasus</str<strong>on</strong>g> Safari Exploit<br />
The first stage <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>Pegasus</str<strong>on</strong>g> exploits a vulnerability in WebKit’s JavaScriptCore library (CVE-<br />
2016-4657). The exploit uses <str<strong>on</strong>g>the</str<strong>on</strong>g> Safari web browser to run a JavaScript payload that exploits<br />
<str<strong>on</strong>g>the</str<strong>on</strong>g> initial vulnerability to gain arbitrary code executi<strong>on</strong> in <str<strong>on</strong>g>the</str<strong>on</strong>g> c<strong>on</strong>text <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> Safari WebC<strong>on</strong>tent<br />
process.<br />
Background<br />
The vulnerability exists within <str<strong>on</strong>g>the</str<strong>on</strong>g> slowAppend() method <str<strong>on</strong>g>of</str<strong>on</strong>g> MarkedArgumentBuffer and can be<br />
exploited via <str<strong>on</strong>g>the</str<strong>on</strong>g> usage <str<strong>on</strong>g>of</str<strong>on</strong>g> a MarkedArgumentBuffer in <str<strong>on</strong>g>the</str<strong>on</strong>g> static defineProperties() method. The<br />
defineProperties() method accepts as input an object whose own enumerable properties<br />
c<strong>on</strong>stitute descriptors for <str<strong>on</strong>g>the</str<strong>on</strong>g> properties to be defined or modified <strong>on</strong> ano<str<strong>on</strong>g>the</str<strong>on</strong>g>r target object. The<br />
algorithm used to associate each <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g>se properties with <str<strong>on</strong>g>the</str<strong>on</strong>g> target object does two iterati<strong>on</strong>s <str<strong>on</strong>g>of</str<strong>on</strong>g><br />
<str<strong>on</strong>g>the</str<strong>on</strong>g> provided list <str<strong>on</strong>g>of</str<strong>on</strong>g> properties. In <str<strong>on</strong>g>the</str<strong>on</strong>g> first pass, each <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> property descriptors is checked for<br />
proper formatting and a PropertyDescriptor object is created that references <str<strong>on</strong>g>the</str<strong>on</strong>g> underlying<br />
value.<br />
size_t numProperties = propertyNames.size();<br />
Vector descriptors;<br />
MarkedArgumentBuffer markBuffer;<br />
for (size_t i = 0; i < numProperties; i++) {<br />
JSValue prop = properties->get(exec, propertyNames[i]);<br />
if (exec->hadExcepti<strong>on</strong>())<br />
return jsNull();<br />
PropertyDescriptor descriptor;<br />
if (!toPropertyDescriptor(exec, prop, descriptor))<br />
return jsNull();<br />
descriptors.append(descriptor);<br />
The sec<strong>on</strong>d pass is performed after each property has been validated. This pass associates<br />
each <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> user-supplied properties with <str<strong>on</strong>g>the</str<strong>on</strong>g> target object, using <str<strong>on</strong>g>the</str<strong>on</strong>g> type specific<br />
defineOwnProperty() method.<br />
for (size_t i = 0; i < numProperties; i++) {<br />
Identifier propertyName = propertyNames[i];<br />
if (exec->propertyNames().isPrivateName(propertyName))<br />
c<strong>on</strong>tinue;<br />
object->methodTable(exec->vm())->defineOwnProperty(object, exec, propertyName,<br />
descriptors[i], true);<br />
This method may result in user-defined JavaScript methods (that are associated with <str<strong>on</strong>g>the</str<strong>on</strong>g><br />
property being defined) being called. Within any <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g>se user-defined methods, it is possible<br />
that a garbage collecti<strong>on</strong> cycle may be triggered, resulting in any unmarked heap backed<br />
objects being free()ed. Therefore, it is important that each <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> temporary references to <str<strong>on</strong>g>the</str<strong>on</strong>g>se<br />
Page 3