full-disclosure - [FD] Yet another fork()/malloc() bomb in javascript + SIGILL in Chrome

Open Source and information security mailing list archives

Message-ID: <CAGUWgD9yEiGf2OmNwmoOVrAd+m5Z6uEph=h-34+Qoqh7LfyWJw@mail.gmail.com>
Date: Thu, 25 Jan 2024 10:59:36 +0200
From: Georgi Guninski <gguninski@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Yet another fork()/malloc() bomb in javascript + SIGILL in
	Chrome

Searching the web for `javascript fork malloc bomb` returns results,
e.g. [here][1]: and [here][2]:

We got a javascript fork malloc bomb which crashed Chrome 121 on linux
with SIGILL and about one in five runs the virtual machine freezes.
SIGILL almost always is a sign of memory corruption :)
On android it crashes the current tab without explanation.
Firefox 121 on linux also crashes the current tab.

In all cases except the sporadic freezes, the browser remains functioning,
not counting the crashed tab.

The javscript code is simply simple:

`setInterval("document.body.innerHTML += document.body.innerHTML ",1);`

[Online demo][3]: In case someone wants to test it on other browsers
or debug.

The GNU/linux tests took about 1.5 minutes in a virtual machine with
4GB RAM and single core.

[1]: http://wiki.glitchdata.com/index.php/Examples_of_fork_bombs#JavaScript
[2]: https://gist.github.com/betandr/f0cbbb663accc3a76c11cc7661711566#javascript
[3]: https://www.guninski.com/fork1.html
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives