Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Heap Feng Shader: Exploiting SwiftShader in Chrome

projectzero.google | blog | #chrome | #project-zero | #swiftshader | #heap-feng-shui

Summary

On the majority of systems, under normal conditions, SwiftShader will never be used by Chrome - it’s used as a fallback if you have a known-bad “blacklisted” graphics card or driver. However, Chrome can also decide at runtime that your graphics driver is having issues, and switch to using SwiftShader to give a better user experience. If you’re interested to see the performance difference, or just to have a play, you can launch Chrome using SwiftShader instead of GPU acceleration using the --disable-gpu command line flag.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
Virtually Unlimited Memory: Escaping the Chrome Sandbox
After discovering a collection of possible sandbox escape vulnerabilities in Chrome, it seemed worthwhile to exploit one of these issues as a full-chain exploit together with a renderer vulnerability to get a better understanding of the mechanics required for a modern Chrome exploit. Considering the available bugs, the most likely appeared to be issue 1755, a use-after-free with parallels to classic Javascript engine callback bugs. This is a good candidate because of the high level of control the attacker has both over the lifetime of the free’d object, and over the timing of the later use of the object.
research · projectzero.google
Exploiting NVMAP to escape the Chrome sandbox - CVE-2014-5332
A Google Project Zero post exploiting a bug in NVIDIA's NVMAP driver (CVE-2014-5332) to escape the Chrome for Android sandbox.
research · projectzero.google
[CVE-2014-3196] Did the “Man With No Name” Feel Insecure?
A Google Project Zero post on CVE-2014-3196, a Windows Chrome bug fixed in M38 that served as an early link in a potential exploit chain.
blog · projectzero.google
Escaping the Chrome Sandbox with RIDL
Guest blog post by Stephen Röttger
blog · projectzero.google
A day^W^W Several months in the life of Project Zero - Part 1: The Chrome bug of suffering
It was a normal week in the Project Zero office when we got an interesting email from the Chrome team — they’d been looking into a serious crash that was happening occasionally on Android builds of Chrome, but hadn’t made much progress. The same crash had then briefly reproduced on ClusterFuzz; with a test-case which referenced an external website — but it wasn’t reproducing any more, and it seemed likely that the next step was going to be to wait until the bug started reproducing again.
blog · projectzero.google
A day^W^W Several months in the life of Project Zero - Part 2: The Chrome exploit of suffering
After we’d understood how the bug worked, and had passed on those details to Chrome to help them get started on a fix, we went back to our other projects. This bug remained a topic of discussion, and eventually we ran out of excuses for not trying to write an exploit for it.
back