Hacking Suggestion Webkit CVEs published on Nov. 22nd

[ZiggyDeer]

Hello GBATemp! I recently discovered a whole bunch of proof-of-concept use-after-free exploits posted by the Google Security Team that target Apple Webkit. Since they are only about a week old in terms of their publication, I figured there hasn't been a patch for them on the Switch yet. I will put those POCs down at the bottom of this post.

Now, before you start bringing the hype up, I want to remind you that these are only proof-of-concepts, and will not do anything at the moment besides maybe crashing the browser. Not all use-after-free vulnerabilities can be used to gain privileges or anything like that, and there's also ARM TrustZone that you have to worry about. However, the folks over at Google did publish a total of 8 UAF exploits within WebKit, so maybe there is hope.

Let's hope a more experienced developer will try and pick this up. I've been trying to use QEMU to emulate an aarch64 Debian distro with a Cortex-a57 CPU, but it's just too slow. So I figured the better solution was to buy a Raspberry Pi 3 and debug on that, so that should come in on Thursday.

Anyways, here is the HTML/JS for the 8 POC exploits. I hope this can become useful!

Spoiler: CVE-2017-13791

This user does not have permission to use the HTML BB code.

Spoiler: CVE-2017-13798

This user does not have permission to use the HTML BB code.

Spoiler: CVE-2017-13794

This user does not have permission to use the HTML BB code.

Spoiler: CVE-2017-13802

This user does not have permission to use the HTML BB code.

Spoiler: CVE-2017-13795

This user does not have permission to use the HTML BB code.

Spoiler: CVE-2017-13797

This user does not have permission to use the HTML BB code.

Spoiler: CVE-2017-13792

This user does not have permission to use the HTML BB code.

Spoiler: CVE-2017-13796

This user does not have permission to use the HTML BB code.

 

[Deleted User]

Hope to god a 4.01 exploit is announced but since it patches a big vulnerability to execute Homebrew most likely not and since this is a proof-of-concept it's a 50-50 chance that something will happen

 

[Beerus]

Hope to god a 4.01 exploit is announced but since it patches a big vulnerability to execute Homebrew most likely not and since this is a proof-of-concept it's a 50-50 chance that something will happen

highly doubt anything will happen soon but hey its not bad to keep on dreaming

--------------------- MERGED ---------------------------

coolio my dude

 

[Deleted User]

New CVEs come in heaploads on a constant basis. Copy pasting example PoCs from around the web and failing to mention it's not your code can also be kind of underhanded (especially with the way you posted this). And lastly, if someone randomly googling around and copy pasting other people's code on gbatemp is aware of a possible vulnerability, then it's already well known.


At least just post the link instead of formatting it make it seem like your work

https://www.exploit-db.com/exploits/43176/

 

[MeowMeowMeow]

New CVEs come in heaploads on a constant basis. Copy pasting example PoCs from around the web and failing to mention it's not your code can also be kind of underhanded (especially with the way you posted this). And lastly, if someone randomly googling around and copy pasting other people's code on gbatemp is aware of a possible vulnerability, then it's already well known.


At least just post the link instead of formatting it make it seem like your work

https://www.exploit-db.com/exploits/43176/

Dude read his first sentence.. calm down lmao he is not stealing someones work. Ooooh the irony tho.

Hello GBATemp! I recently discovered a whole bunch of proof-of-concept use-after-free exploits posted by the Google Security Team that target Apple Webkit. Since they are only about a week old in terms of their publication, I figured there hasn't been a patch for them on the Switch yet. I will put those POCs down at the bottom of this post.

 

[wyjek]

nice finding

 

[Deleted User]

Dude read his first sentence.. calm down lmao he is not stealing someones work. Ooooh the irony tho.

Well shit yeah actually my bad on that one. I did the thing I get pissed at others for so often, skimming. My apologies OP.

 

[machinoman]

Well shit yeah actually my bad on that one. I did the thing I get pissed at others for so often, skimming. My apologies OP.

Somebody maturely admitting they made a mistake... on GBATemp... does not compute. Error. (Crash)