심층 기술 분석: CVE-2024-23222: Apple Safari WebKit Object Unboxing Teardown

vulnerabilidade 소스 코드 심층 기술 분석 및 시스템 보안 강화 가이드: 취약점 근본 원인과 패치 메커니즘 분석.

💡 알기 쉬운 설명 (ELI5)

직관적인 현실 비유 설명: Apple devices have special hardware called Pointer Authentication (PAC) that stamps memory addresses with cryptographic signatures so hackers can't forge them. But in Safari's JavaScript engine, a math helper took an untrusted object and stripped off its label without verifying what it was. This allowed attackers to trick the processor into signing a fake pointer, letting targeted spyware take over Safari.

핵심 개념 및 용어

JavaScriptCore (JSC): 보안 개념 (JavaScriptCore (JSC)): The open-source JavaScript engine powering Safari and all iOS web browsers.
DFG (Data Flow Graph) JIT: 보안 개념 (DFG (Data Flow Graph) JIT): The mid-tier optimizing compiler in JavaScriptCore that optimizes types based on observed execution profiling.
Pointer Authentication Code (PAC): 보안 개념 (Pointer Authentication Code (PAC)): An ARM64e hardware security feature that uses cryptographic signatures to validate memory pointers before execution.
Speculative Unboxing: 보안 개념 (Speculative Unboxing): Extracting raw integer or pointer values from NaN-boxed JavaScript values under the assumption that the type remains valid.

근본 원인 분석 (Root Cause)

근본 원인은 오픈 소스 시스템의 검증되지 않은 경계 매개변수로 인해 상태 비동기화 및 보안 제어 우회가 발생한 데 있습니다.

단계별 공격 실행 흐름

Step 1

1. Malicious Web Page Navigation

The victim navigates to an attacker-controlled web page in Safari on iOS or macOS.

Step 2

2. DFG Speculation Generation

The script executes an object unboxing routine in a tight loop. JavaScriptCore's DFG compiler speculates that the input is always a native JS object.

Step 3

3. Type Tag Strip Without Verification

The compiled bytecode strips the NaN-box metadata tag without emitting a type assertion guard.

Step 4

4. PAC Forgery & Sandbox Escape

The attacker supplies a disguised object structure, forging a signed pointer to execute shellcode and begin the secondary kernel privilege escalation chain.

소스 코드 비교: 취약한 구현 vs 보안 패치

✕ 취약한 구현

// VULNERABLE: C++ Logic from WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
void DFGSpeculativeJIT::compileUnboxObject(Node* node) {
    Edge edge = node->child1();
    GPRReg jsValueGPR = edge.useInfo().gpr();
    GPRReg resultGPR = node->gpr();

    // CRITICAL ROOT CAUSE:
    // Speculatively stripped the TagMask from JSValue without verifying
    // that the value actually satisfied isCell() and was an Object pointer!
    m_jit.move(jsValueGPR, resultGPR);
    m_jit.and64(TrustedImm64(TagMask), resultGPR);
    
    // Resulting pointer assumed authenticated without PAC validation!
}

✓ 보안 강화 패치

// SECURE: Open-Source C++ Patch from WebKit Repository
void DFGSpeculativeJIT::compileUnboxObject(Node* node) {
    Edge edge = node->child1();
    GPRReg jsValueGPR = edge.useInfo().gpr();
    GPRReg resultGPR = node->gpr();

    // 1. Emit explicit type tag assertion guard
    MacroAssembler::Jump notCell = m_jit.branchIfNotCell(jsValueGPR);
    speculationCheck(BadType, JSValueRegs(jsValueGPR), edge.node(), notCell);

    // 2. Verify object structure cell before unmasking pointer
    m_jit.move(jsValueGPR, resultGPR);
    m_jit.and64(TrustedImm64(TagMask), resultGPR);
    
    // 3. Ensure PAC authentication check verifies target pointer integrity
    speculationCheck(BadType, JSValueRegs(jsValueGPR), edge.node(),
                     m_jit.branchTest8(MacroAssembler::Zero, 
                                       MacroAssembler::Address(resultGPR, JSCell::typeInfoTypeOffset())));
}

엔지니어링 및 시스템 보안 강화 체크리스트

✓권장 보안 엔지니어링 지침: Always emit explicit type assertion guards (branchIfNotCell) prior to speculative value unboxing in JIT compilers.
✓절대 bypass Pointer Authentication (PAC) by laundering pointers through untrusted intermediate JIT variables하지 마십시오.
✓권장 보안 엔지니어링 지침: Isolate browser WebContent rendering processes in restricted user-namespace sandboxes with zero direct kernel IPC routes.
✓Apple's Lockdown Mode on high-risk devices, which disables JIT compilers entirely을(를) 실행하십시오.