![](https://csdnimg.cn/release/download_crawler_static/11050524/bg8.jpg)
referencestoapropertyvaluecouldberemovedwithinthisuserdefinedJavaScriptcode.If
garbagecollectioncanbetriggeredbetweentheremovalofallremainingreferencestoa
propertyvalueandthe(nowstale)valuefromthedescriptorsvectorbeingdefinedonthetarget
object,areferencetofree()edmemorywillbedefinedasapropertyonthetargetobject.
Exploitation
ThePegasusexploittriggersthisvulnerabilitybypassingaspecificallycraftedsequenceof
propertiestothedefineProperties()method.Whentheseindividualpropertiesaresubsequently
insertedintoaMarkedArgumentBufferthevulnerabilityistriggeredsuchthataJSArrayobject
willbeimproperlydeallocatedifgarbagecollectioncanbetriggeredatacriticalpointintime.
Becausegarbagecollectioncannotbetriggereddeterministically,theexploitmakesrepeated
attemptstotriggertheimproperdeallocationandsubsequentreallocation(foratotaloften
attempts),testingeachtimewhetherastalereferencehasbeensuccessfullyacquired.
Assuminggarbagecollectionhasbeentriggeredatthecorrecttime,anotherobjectisallocated
overthetopofthenowstaleJSArray.Theexploitthensetsupthetoolsneededtogainarbitrary
nativecodeexecution,namelyaread/writeprimitiveandtheabilitytoleaktheaddressofan
arbitraryJavaScriptobject.Oncethisiscompletetheexploitcancreateanexecutablemapping
containingthenativecodepayload.Thefollowingsectionsdetailthevariousstagesofthis
process.
Settingupandtriggeringthevulnerability
Inordertoachievearbitrarycodeexecution,theexploittriggersthevulnerablecodepathusing
aJSArrayobject.Thefollowingpseudocodeisusedtotriggerthevulnerability.
vararr=newArray(2047);
varnot_number={};
not_number.toString=function(){
arr=null;
props["stale"]["value"]=null;
…//Triggergarbagecollectionandreallocationoverstaleobject
return10;
};
varprops={
p0:{value:0},
p1:{value:1},
p2:{value:2},
p3:{value:3},
p4:{value:4},
p5:{value:5},
p6:{value:6},
p7:{value:7},
p8:{value:8},
length:{value:not_number},
stale:{value:arr},
after:{value:666}
};
Page7