Later archive addition

The Devil is in the Constants: Bypassing Defenses in Browser JIT Engines

Michalis Athanasakis, Elias Athanasopoulos, Michalis Polychronakis, Georgios Portokalidis and Sotiris Ioannidis

JavaScript integer constants survive into a JIT engine generated code, so an attacker can encode x86 gadget bytes as immediate values and make Firefox or Internet Explorer emit a full ROP chain at run time, defeating ASLR, DEP and the undocumented JIT hardening in IE. Gadgets can also be located on the fly, and blinding every constant costs up to 80 percent more instructions.

Record

Researcher

Michalis Athanasakis, Elias Athanasopoulos, Michalis Polychronakis, Georgios Portokalidis and Sotiris Ioannidis

Format

Whitepaper

In the archive

• Added to the 2015 archive after the original list was published

Tags

• gadget-chain
• rce
• javascript-runtime
• javascript
• mitigation
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Michalis Athanasakis, Elias Athanasopoulos, Michalis Polychronakis, Georgios Portokalidis and Sotiris Ioannidis, first published at the original source. Preserved copies are kept so the citation survives its host.