Технический разбор: CVE-2024-23222: Apple Safari WebKit Object Unboxing Teardown

Технический анализ исходного кода и защитные инженерные меры для vulnerabilidade: How JavaScriptCore's DFG JIT compiler failed to verify object type tags before unboxing, allowing targeted spyware to bypass Pointer Authentication (PAC) on iOS and macOS.

💡 Простыми словами (ELI5)

Наглядная аналогия: Apple devices have special hardware called Pointer Authentication (PAC) that stamps memory addresses with cryptographic signatures so hackers can't forge them. But in Safari's JavaScript engine, a math helper took an untrusted object and stripped off its label without verifying what it was. This allowed attackers to trick the processor into signing a fake pointer, letting targeted spyware take over Safari.

Ключевые понятия и термины

JavaScriptCore (JSC): Технический термин (JavaScriptCore (JSC)): The open-source JavaScript engine powering Safari and all iOS web browsers.
DFG (Data Flow Graph) JIT: Технический термин (DFG (Data Flow Graph) JIT): The mid-tier optimizing compiler in JavaScriptCore that optimizes types based on observed execution profiling.
Pointer Authentication Code (PAC): Технический термин (Pointer Authentication Code (PAC)): An ARM64e hardware security feature that uses cryptographic signatures to validate memory pointers before execution.
Speculative Unboxing: Технический термин (Speculative Unboxing): Extracting raw integer or pointer values from NaN-boxed JavaScript values under the assumption that the type remains valid.

Анализ первопричины

Основная причина заключается в невалидированных граничных параметрах в системах с открытым исходным кодом, что приводит к рассинхронизации состояний и обходу средств безопасности.

Пошаговый сценарий атаки

Step 1

1. Malicious Web Page Navigation

The victim navigates to an attacker-controlled web page in Safari on iOS or macOS.

Step 2

2. DFG Speculation Generation

The script executes an object unboxing routine in a tight loop. JavaScriptCore's DFG compiler speculates that the input is always a native JS object.

Step 3

3. Type Tag Strip Without Verification

The compiled bytecode strips the NaN-box metadata tag without emitting a type assertion guard.

Step 4

4. PAC Forgery & Sandbox Escape

The attacker supplies a disguised object structure, forging a signed pointer to execute shellcode and begin the secondary kernel privilege escalation chain.

Исходный код: Уязвимый vs Защищённый вариант

✕ УЯЗВИМАЯ РЕАЛИЗАЦИЯ

// VULNERABLE: C++ Logic from WebKit/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
void DFGSpeculativeJIT::compileUnboxObject(Node* node) {
    Edge edge = node->child1();
    GPRReg jsValueGPR = edge.useInfo().gpr();
    GPRReg resultGPR = node->gpr();

    // CRITICAL ROOT CAUSE:
    // Speculatively stripped the TagMask from JSValue without verifying
    // that the value actually satisfied isCell() and was an Object pointer!
    m_jit.move(jsValueGPR, resultGPR);
    m_jit.and64(TrustedImm64(TagMask), resultGPR);
    
    // Resulting pointer assumed authenticated without PAC validation!
}

✓ БЕЗОПАСНЫЙ ИСПРАВЛЕННЫЙ ВАРИАНТ

// SECURE: Open-Source C++ Patch from WebKit Repository
void DFGSpeculativeJIT::compileUnboxObject(Node* node) {
    Edge edge = node->child1();
    GPRReg jsValueGPR = edge.useInfo().gpr();
    GPRReg resultGPR = node->gpr();

    // 1. Emit explicit type tag assertion guard
    MacroAssembler::Jump notCell = m_jit.branchIfNotCell(jsValueGPR);
    speculationCheck(BadType, JSValueRegs(jsValueGPR), edge.node(), notCell);

    // 2. Verify object structure cell before unmasking pointer
    m_jit.move(jsValueGPR, resultGPR);
    m_jit.and64(TrustedImm64(TagMask), resultGPR);
    
    // 3. Ensure PAC authentication check verifies target pointer integrity
    speculationCheck(BadType, JSValueRegs(jsValueGPR), edge.node(),
                     m_jit.branchTest8(MacroAssembler::Zero, 
                                       MacroAssembler::Address(resultGPR, JSCell::typeInfoTypeOffset())));
}

Чек-лист по защите системы для инженеров

✓Рекомендация по безопасности: Always emit explicit type assertion guards (branchIfNotCell) prior to speculative value unboxing in JIT compilers.
✓Никогда не bypass Pointer Authentication (PAC) by laundering pointers through untrusted intermediate JIT variables.
✓Рекомендация по безопасности: Isolate browser WebContent rendering processes in restricted user-namespace sandboxes with zero direct kernel IPC routes.
✓Запускайте Apple's Lockdown Mode on high-risk devices, which disables JIT compilers entirely.