insaida/cve-2024-0519-rca-researchCVE-2024-0519 root cause analysis
Root cause analysis artifacts for CVE-2024-0519 (V8 out-of-bounds memory access, Chrome 120, exploited in the wild).
Fix: e0f2a195d87c9a06685121e0e783efd92d030df3 — Toon Verwaest, 2024-01-12
V8 version studied: 12.0.267.16 (fbc4963bbff), ARM64 macOS
| Path | Description |
|---|---|
harness/test-toctou-race.cc | C++ cctest confirming the TOCTOU race window in GetOwnFastDataPropertyFromHeap |
harness/test-toctou-chain.cc | C++ cctest demonstrating filler embedded as HeapConstant via the broker pipeline |
js/poc_325020448.js | Zero-intrinsics JS trigger for chromium:325020448 (sibling bug, no public CVE) |
js/regress_325020448.js | Official V8 regression test for chromium:325020448 (requires --allow-natives-syntax) |
patches/e0f2a195.md | Fix commit metadata |
# Pre-patch d8 (V8 12.0.267.16, one commit before e0f2a195)
./d8 --concurrent-recompilation js/poc_325020448.js
# C++ cctests — integrate into V8 cctest build, then:
./cctest test-toctou-race/ToctouRaceDeleteProperty
./cctest test-toctou-chain/EndToEndChainInstallNoPatch
./cctest test-toctou-chain/ConsequenceJSConsumption
See BUILD.md for build instructions.
Sibling bug in the same PropertyConstness::kConst class — constness not generalized across prototype transitions. Fixed by 496f467bb72 (Feb 19, 2024), five weeks after the CVE-2024-0519 fix. No public CVE assigned. Affects Chrome 122 (post-CVE-2024-0519 patch) through Chrome 123.
js/poc_325020448.js triggers it without any V8 natives flags.