A Framework for Automatic Exploit Generation for JIT Compilers

Xiyu Kang, Saumya Debray

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

This paper proposes a framework for automatic exploit generation in JIT compilers, focusing in particular on heap corruption vulnerabilities triggered by dynamic code, i.e., code generated at runtime by the JIT compiler. The purpose is to help assess the severity of vulnerabilities and thereby assist with vulnerability triage. The framework consists of two components: the first extracts high-level representations of exploitation primitives from existing exploits, and the second uses the primitives so extracted to construct exploits for new bugs. We are currently building a prototype implementation of the framework focusing on JavaScript JIT compilers. To the best of our knowledge, this is the first proposal to consider automatic exploit generation for code generated dynamically by JIT compilers.

Original languageEnglish (US)
Title of host publicationCheckMate 2021 - Proceedings of the 2021 Research on Offensive and Defensive Techniques in the Context of Man At The End (MATE) Attacks, co-located with CCS 2021
PublisherAssociation for Computing Machinery, Inc
Pages11-19
Number of pages9
ISBN (Electronic)9781450385527
DOIs
StatePublished - Nov 19 2021
Event2021 Workshop on Research on Offensive and Defensive Techniques in the Context of Man At The End (MATE) Attacks, CheckMate 2021 - Virtual, Online, Korea, Republic of
Duration: Nov 19 2021 → …

Publication series

NameCheckMate 2021 - Proceedings of the 2021 Research on Offensive and Defensive Techniques in the Context of Man At The End (MATE) Attacks, co-located with CCS 2021

Conference

Conference2021 Workshop on Research on Offensive and Defensive Techniques in the Context of Man At The End (MATE) Attacks, CheckMate 2021
Country/TerritoryKorea, Republic of
CityVirtual, Online
Period11/19/21 → …

Keywords

  • automatic exploit generation
  • dynamic code
  • jit compiler in javascript engines

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Computer Science Applications
  • Software

Cite this