Abstract

JavaScript JIT compilers are still a major focus of web browser exploitation. Research often focuses on stages of the compiler pipeline with a direct security impact, like bounds-check elimination and the closely related value range analysis. However, correctness of these optimizations can equally be affected by bugs in later, seemingly unrelated stages: If an expression is wrongly evaluated, the incorrect result might not match the computed value-range type, even if the type itself was assigned correctly. These "time-traveling" vulnerabilities - where a bug in a later stage is used to break assumptions of an earlier one - can however be somewhat tricky to exploit. In this talk I will show some recent examples of such misevaluation bugs, focusing on what is necessary to get from wrong result to memory corruption, and ultimately code execution.