Abstract:—Many mechanisms have been proposed and de-ployed to prevent exploits against software vulnerabilities. Amongthem, W X is one of the most effective and efﬁcient. W Xprevents memory pages from being simultaneously writableand executable, rendering the decades old shellcode injectiontechnique infeasible.In this paper, we demonstrate that the traditional shellcodeinjection attack can be revived through a code cache injectiontechnique. Speciﬁcally, dynamic code generation, a techniquewidely used in just-in-time (JIT) compilation and dynamic binarytranslation (DBT), generates and modiﬁes code on the ﬂy in orderto promote performance or security. The dynamically generatedcode fragments are stored in a code cache, which is writableand executable either at the same time or alternately, resultingin an opportunity for exploitation. This threat is especiallyrealistic when the generated code is multi-threaded, becauseswitching between writable and executable leaves a time windowfor exploitation. To illustrate this threat, we have crafted a proof-of-concept exploit against modern browsers that support WebWorkers.To mitigate this code cache injection threat, we propose anew dynamic code generation architecture. This new architecturerelocates the dynamic code generator to a separate process,in which the code cache is writable. In the original processwhere the generated code executes, the code cache remains read-only. The code cache is synchronized across the writing processand the execution process through shared memory. Interactionbetween the code generator and the generated code is handledtransparently through remote procedure calls (RPC). We haveported the Google V8 JavaScript engine and the Strata DBTto this new architecture. Our implementation experience showedthat the engineering effort for porting to this new architectureis minimal. Evaluation of our prototype implementation showedthat this new architecture can defeat the code cache injectionattack with small performance overhead.

A Review on JavaScript Engine Vulnerability Mining

AMF: Efficient Browser Interprocess Communication Fuzzing

Exposing Bugs in JavaScript Engines through Test Transplantation and Differential Testing

Montage: A Neural Network Language Model-Guided JavaScript Engine Fuzzer

Abusing Hidden Properties to Attack the Node.js Ecosystem

Mayall: A Framework for Desktop JavaScript Auditing and Post-Exploitation Analysis

Exploiting and Protecting Dynamic Code Generation.

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

SoK: In Search of Lost Time: A Review of JavaScript Timers in Browsers

FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques

Prime+Probe 1, JavaScript 0: Overcoming Browser-based Side-Channel Defenses

Detile: Fine-Grained Information Leak Detection in Script Engines

Research progress of Web vulnerability mining based on machine learning

FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities

Malicious JavaScript Code Detection Based on Hybrid Analysis

Vulnerability discovery based on source code patch commit mining: a systematic literature review

GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes

Statically Detecting JavaScript Obfuscation and Minification Techniques in the Wild

SOK: On the Analysis of Web Browser Security

Virtual Browser: A Web-Level Sandbox To Secure Third-Party Javascript Without Sacrificing Functionality

Network computer security hidden dangers and vulnerability mining technology