jaf0rk/CVE-2026-9973-exploit
GitHub: jaf0rk/CVE-2026-9973-exploit
针对 V8 引擎 Turboshaft Load Elimination 中 Phi 处理缺陷的 PoC 漏洞利用代码，可实现对象地址伪造。
Stars: 0 | Forks: 0
# CVE-2026-9973
## Bug 修复
https://chromium-review.googlesource.com/c/v8/v8/+/7822799
```
[wasm][turboshaft] Fix Phi handling in Load Elimination some more
Multiple Phis can depend on each other, so we have to clear all their
replacements up front.
Fixed: 509268941
Change-Id: I7899b28e89ed7b470bd869fb52f7443589305171
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7822799
Reviewed-by: Darius Mercadier
Auto-Submit: Jakob Kummerow
Commit-Queue: Jakob Kummerow
Cr-Commit-Position: refs/heads/main@{#107278}
```
## 环境
**OS**: Ubuntu 24.04 noble x64
**v8 版本**: 14.8.178.21
```
commit e38030f4228c8d1405fe105fc5feaa5173559e25 (HEAD -> 14.8.178.21, tag: 14.8.178.21-pgo, tag: 14.8.178.21)
Author: V8 Autoroll
Date: Wed May 6 13:34:13 2026 -0700
Version 14.8.178.21
Version incremented at https://cr-buildbucket.appspot.com/build/8682521216270456209
Change-Id: I16a5eb6f12bf2c64d5a7eac752a09128e4eac6fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7822581
Bot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com
Cr-Commit-Position: refs/branch-heads/14.8@{#43}
Cr-Branched-From: f9659283a5f8d42b3c09228cf5df606fcaf47a3d-refs/heads/14.8.178@{#1}
Cr-Branched-From: 141232520dc4910401240c531db3af36910a0fd1-refs/heads/main@{#106240}
```
**构建参数**:
```
# 在此处设置 build arguments。参见 `gn help buildargs`。
is_debug = false
dcheck_always_on = false
v8_symbol_level = 2
v8_enable_object_print = true
v8_enable_sandbox = true
target_os = "linux"
target_cpu = "x64"
```
## 用法
运行 ExP：
```
d8 --allow-natives-syntax exp.js
```
## 补充说明
关于 V8 沙箱逃逸部分的研究仍在进行中。
## 结果
elements == object address
```
=========================Address=========================
fake object address: 1060f5d
=======================DebugPrint========================
DebugPrint: 0x16201060f5d: [JSArray]
- map: 0x01620100d0d9 [FastProperties]
- prototype: 0x01620100ca3d
- elements: 0x016201060f5d [PACKED_DOUBLE_ELEMENTS]
- length: 2
- properties: 0x0162000007e5
- All own properties (excluding elements): {
0x16200000e19: [String] in ReadOnlySpace: #length: 0x0162001a6add , data= 0x016200000011 > (const accessor descriptor, attrs: [W__])
}
// This is object address
- elements: 0x016201060f5d { Unexpected elements backing store
}
0x1620100d0d9: [Map] in OldSpace
- map: 0x016201004939 )>
- type: JS_ARRAY_TYPE
- instance size: 16
- inobject properties: 0
- unused property fields: 0
- elements kind: PACKED_DOUBLE_ELEMENTS
- enum length: invalid
- back pointer: 0x01620100d095
- prototype_validity_cell: 0x016200000af1
- instance descriptors #1: 0x01620100d059
- transitions #1: 0x01620100d101
Transitions #1:
0x016200000eb5 : (transition to HOLEY_DOUBLE_ELEMENTS) -> 0x01620100d11d
- prototype: 0x01620100ca3d
- constructor: 0x01620100c965
- dependent code: 0x0162000007f5
- construction counter: 0
```
|
标签：AI工具, V8引擎, WebAssembly, Web报告查看器, 数据可视化, 沙箱逃逸, 编译器, 自定义脚本