doar-e

Interested readers should check out the author's earlier work exploiting CVE-2019-9810: https://github.com/0vercl0k/CVE-2019-9810 And their fantastically detailed writeup of a PoC they wrote for that vulnerability: https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey-root… This exploit is different in that they use the arbitrary read/write primitive gained by CVE-2019-9810 to flip a couple of bits and patch out a few instructions with the effect of removing the security boundary between a normal web page and XPCOM. The interesting difference in this exploitation approach is there's no need for ROP chains and shellcode, as you have all the XPCOM components available to use. Once they're in that privileged context in the content process, they escape its sandbox by exploiting CVE-2019-11708. This works by sending an particular IPC message to the parent process, that causes a web page of the exploiter's choice to load in that process. In this case, the choice is to exploit CVE-2019-9810 again, then use XPCOM components to drop an executable to disk and run it. Awesome work, and a real pleasure to read, it's satisfying to see such well-commented and clear exploit code.

Short-answer: The debugger (in Windows) sits between the first and second and chances, if I recall correctly, to "help" the user by displaying a dialogue notifying them that 'x' is unhandled. Anything in second chance has reached the kernel for handling and is no longer in the user space. You'll often see this (second chance) as exception entries in the Windows Event Log for things like kernelbase.dll, which points to the offending instruction set. The handler in this space typically invokes Watson to generate Watson reports because it was unhandled elsewhere. The debugger prevents all of that. Of course, in JIT, you have things like read-ahead for first-chance exceptions... A good book, in the Windows space, that cannot recommend enough, is Windows Internals[0]. They include how the managed and user spaces interact and coincide with the native and kernel spaces and how all of that transpires, such as how an exception in user mode transitions to kernel before Watson report is created. There's other in-depth resources[1], as well, if books aren't your thing. [0] - https://docs.microsoft.com/en-us/sysinternals/learn/windows-internals [1] - https://doar-e.github.io/blog/2013/10/12/having-a-look-at-the-windows-…

This ensures aborting bounds checks to some parts of the the pipeline, but this doesn't mean that later optimizations can't determine that the check is dead code and remove it. For example: https://doar-e.github.io/blog/2019/05/09/circumventing-chromes-hardeni…

Seas of nodes are also used as IR in Java Hotspot and the V8 engine (https://doar-e.github.io/blog/2019/01/28/introduction-to-turbofan/)

I was a developer at Microsoft in the 90s (Visual Studio (Boston) and Windows teams). I won't claim that software back then was "better," but what is definitely true is that we had to think about everything at a much lower level. For example, you had to know which Win32 functions caused ring-3 -> ring-0 transitions because those transitions could be incredibly costly. You couldn't just "find the right function" and move on. You had to find the right function that wouldn't bring your app (and entire system) to its knees. I specifically remember hating my life whenever we ran into a KiUserExceptionDispatcher [0] issue, because even something as simple as an exception could kill your app's performance. Additionally, we didn't get to just patch flaws as they arose. We either had to send out patches on floppy disks, post them to BBSs, or even send them to PC Magazine. [0]: https://doar-e.github.io/blog/2013/10/12/having-a-look-at-the-windows-…