Later archive addition

Too LeJIT to Quit: Extending JIT Spraying to ARM

Wilson Lian, Hovav Shacham and Stefan Savage

On ARM, constants a JIT compiler embeds in Thumb code can be entered mid-instruction to produce short unintended instruction sequences. Gadget chaining calls these sequences like functions from ordinary JavaScript, giving an attacker with a control-flow bug arbitrary computation against WebKit JavaScriptCore despite DEP, ASLR, constant blinding and NOP insertion.

Record

Researcher

Wilson Lian, Hovav Shacham and Stefan Savage

Format

Whitepaper

In the archive

• Added to the 2015 archive after the original list was published

Tags

• gadget-chain
• javascript-runtime
• javascript
• attack-chain
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Wilson Lian, Hovav Shacham and Stefan Savage, first published at the original source. Preserved copies are kept so the citation survives its host.