Chrome沙箱逃逸案例研究与PlaidCTF 2020 Mojo漏洞分析<\/h1>

Mojo基础<\/h2>

Mojo简介<\/h3>
Mojo是Chromium项目中的进程间通信(IPC)系统，用于在不同进程间传递消息和接口调用。<\/p>

核心概念<\/h3>

Message Pipe<\/strong>：一对端点(endpoints)，每个端点保存一个传入消息队列，写入一端的消息会传送到另一端，实现双向通信。<\/p> <\/li>
Mojom文件<\/strong>：描述一组接口(interfaces)，代表强类型的消息集合。<\/p> <\/li>

Remote与Receiver<\/strong>：<\/p>

Remote：用于发送接口描述的消息<\/li>
Receiver：用于接收接口的消息并分发给具体实现<\/li> <\/ul> <\/li>

接口调用流程<\/strong>：<\/p>

客户端通过Remote发送消息<\/li>
服务端通过Receiver接收并处理消息<\/li>
需要响应时，Receiver会通过Remote返回响应<\/li> <\/ul> <\/li> <\/ol>
Mojo接口开发流程<\/h2>
定义新接口<\/h3>

创建.mojom文件<\/strong>：<\/li> <\/ol>
module example.mojom; interface PingResponder { Ping() => (int32 random); }; <\/code><\/pre> 添加构建规则<\/strong>：<\/li> <\/ol> import("\/\/mojo\/public\/tools\/bindings\/mojom.gni") mojom("mojom") { sources = [ "ping_responder.mojom" ] } <\/code><\/pre> 创建和使用接口管道<\/h3> 创建管道<\/strong>：<\/li> <\/ol> mojo::<\/span>Remote<<\/span>example::<\/span>mojom::<\/span>PingResponder><\/span> ping_responder; <\/span><\/span>mojo::<\/span>PendingReceiver<<\/span>example::<\/span>mojom::<\/span>PingResponder><\/span> receiver =<\/span> <\/span><\/span> ping_responder.BindNewPipeAndPassReceiver(); <\/span><\/span><\/code><\/pre> 发送消息<\/strong>：<\/li> <\/ol> ping_responder-><\/span>Ping(base::<\/span>BindOnce(&<\/span>OnPong)); <\/span><\/span><\/code><\/pre> 发送PendingReceiver到Browser进程<\/strong>：<\/li> <\/ol> RenderFrame*<\/span> my_frame =<\/span> GetMyFrame(); <\/span><\/span>my_frame-><\/span>GetBrowserInterfaceBroker().GetInterface(std::<\/span>move(receiver)); <\/span><\/span><\/code><\/pre>实现接口<\/h3> class<\/span> PingResponderImpl<\/span> :<\/span> example::<\/span>mojom::<\/span>PingResponder { <\/span><\/span> public<\/span>:<\/span> <\/span><\/span> explicit<\/span> PingResponderImpl(mojo::<\/span>PendingReceiver<<\/span>example::<\/span>mojom::<\/span>PingResponder><\/span> receiver) <\/span><\/span> :<\/span> receiver_(this<\/span>, std::<\/span>move(receiver)) {} <\/span><\/span> <\/span><\/span> void<\/span> Ping<\/span>(PingCallback callback) override<\/span> { <\/span><\/span> std::<\/span>move(callback).Run(4<\/span>); <\/span><\/span> } <\/span><\/span> <\/span><\/span> private<\/span>:<\/span> <\/span><\/span> mojo::<\/span>Receiver<<\/span>example::<\/span>mojom::<\/span>PingResponder><\/span> receiver_; <\/span><\/span>}; <\/span><\/span><\/code><\/pre>Mojo绑定类型<\/h2> 1. Self-owned Receivers<\/h3> 自动管理生命周期的接收器：<\/p> mojo::<\/span>MakeSelfOwnedReceiver(std::<\/span>make_unique<<\/span>LoggerImpl><\/span>(), <\/span><\/span> logger.BindNewPipeAndPassReceiver()); <\/span><\/span><\/code><\/pre>2. Receiver Sets<\/h3> 用于多个客户端共享同一个实现实例：<\/p> class<\/span> LogManager<\/span> :<\/span> public<\/span> system::<\/span>mojom::<\/span>LoggerProvider, <\/span><\/span> public<\/span> system::<\/span>mojom::<\/span>Logger { <\/span><\/span> public<\/span>:<\/span> <\/span><\/span> void<\/span> GetLogger(mojo::<\/span>PendingReceiver<<\/span>Logger><\/span> receiver) override<\/span> { <\/span><\/span> logger_receivers_.Add(this<\/span>, std::<\/span>move(receiver)); <\/span><\/span> } <\/span><\/span> private<\/span>:<\/span> <\/span><\/span> mojo::<\/span>ReceiverSet<<\/span>system::<\/span>mojom::<\/span>Logger><\/span> logger_receivers_; <\/span><\/span>}; <\/span><\/span><\/code><\/pre>3. Remote Sets<\/h3> 维护一组Remote，如事件观察者：<\/p> class<\/span> TableImpl<\/span> :<\/span> public<\/span> db::<\/span>mojom::<\/span>Table { <\/span><\/span> public<\/span>:<\/span> <\/span><\/span> void<\/span> AddListener(mojo::<\/span>PendingRemote<<\/span>db::<\/span>mojom::<\/span>TableListener><\/span> listener) { <\/span><\/span> listeners_.Add(std::<\/span>move(listener)); <\/span><\/span> } <\/span><\/span> private<\/span>:<\/span> <\/span><\/span> mojo::<\/span>RemoteSet<<\/span>db::<\/span>mojom::<\/span>Table><\/span> listeners_; <\/span><\/span>}; <\/span><\/span><\/code><\/pre>4. Associated Interfaces<\/h3> 允许在单个消息管道上多路复用多个接口：<\/p> interface Foo { PassBarRemote(pending_associated_remote<Bar> bar); PassBarReceiver(pending_associated_receiver<Bar> bar); }; <\/code><\/pre> JavaScript绑定API<\/h2> 基本用法<\/h3> <script<\/span> src<\/span>=<\/span>"URL\/to\/mojo_bindings.js"<\/span>><\/script<\/span>> <\/span><\/span><script<\/span> src<\/span>=<\/span>"URL\/to\/echo.mojom.js"<\/span>><\/script<\/span>> <\/span><\/span><script<\/span>> <\/span><\/span> var<\/span> echoPtr<\/span> =<\/span> new<\/span> test<\/span>.echo<\/span>.mojom<\/span>.EchoPtr<\/span>(); <\/span><\/span> var<\/span> echoRequest<\/span> =<\/span> mojo<\/span>.makeRequest<\/span>(echoPtr<\/span>); <\/span><\/span><\/script<\/span>> <\/span><\/span><\/code><\/pre>接口实现示例<\/h3> function<\/span> EchoImpl<\/span>() {} <\/span><\/span>EchoImpl<\/span>.prototype<\/span>.echoInteger<\/span> =<\/span> function<\/span>(value<\/span>) { <\/span><\/span> return<\/span> Promise.resolve<\/span>({result<\/span>:<\/span> value<\/span>}); <\/span><\/span>}; <\/span><\/span> <\/span><\/span>var<\/span> echoServicePtr<\/span> =<\/span> new<\/span> test<\/span>.echo<\/span>.mojom<\/span>.EchoPtr<\/span>(); <\/span><\/span>var<\/span> echoServiceRequest<\/span> =<\/span> mojo<\/span>.makeRequest<\/span>(echoServicePtr<\/span>); <\/span><\/span>var<\/span> echoServiceBinding<\/span> =<\/span> new<\/span> mojo<\/span>.Binding<\/span>(test<\/span>.echo<\/span>.mojom<\/span>.Echo<\/span>, <\/span><\/span> new<\/span> EchoImpl<\/span>(), <\/span><\/span> echoServiceRequest<\/span>); <\/span><\/span><\/code><\/pre>漏洞案例分析<\/h2> 案例1: RenderFrameHost生命周期问题<\/h3> 漏洞原理<\/strong>：<\/p> InstalledAppProviderImpl<\/code>通过MakeSelfOwnedReceiver<\/code>与消息管道绑定生命周期<\/li> 但保存了RenderFrameHost<\/code>的原始指针，未绑定生命周期<\/li> 当iframe被移除，RenderFrameHost<\/code>被释放但InstalledAppProviderImpl<\/code>仍存在<\/li> 后续调用FilterInstalledApps<\/code>时使用已释放的RenderFrameHost<\/code><\/li> <\/ol> 关键代码<\/strong>：<\/p> void<\/span> InstalledAppProviderImpl::<\/span>FilterInstalledApps( <\/span><\/span> std::<\/span>vector<<\/span>blink::<\/span>mojom::<\/span>RelatedApplicationPtr><\/span> related_apps, <\/span><\/span> const<\/span> GURL&<\/span> manifest_url, <\/span><\/span> FilterInstalledAppsCallback callback) { <\/span><\/span> if<\/span> (render_frame_host_-><\/span>GetProcess()-><\/span>GetBrowserContext()-><\/span>IsOffTheRecord()) { <\/span><\/span> \/\/ UAF可能发生在这里 <\/span><\/span><\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>案例2: PlaidCTF 2020 Mojo漏洞<\/h3> 漏洞组合<\/strong>：<\/p> UAF漏洞<\/strong>：<\/p> 类似案例1，PlaidStoreImpl<\/code>与消息管道绑定但保存RenderFrameHost<\/code>原始指针<\/li> 移除iframe后仍可通过保留的Remote调用方法<\/li> <\/ul> <\/li> OOB读取漏洞<\/strong>：<\/p> <\/li> <\/ol> void<\/span> PlaidStoreImpl::<\/span>GetData( <\/span><\/span> const<\/span> std::<\/span>string &<\/span>key, <\/span><\/span> uint32_t<\/span> count, <\/span><\/span> GetDataCallback callback) { <\/span><\/span> \/\/ ... <\/span><\/span><\/span><\/span> std::<\/span>vector<<\/span>uint8_t<\/span>><\/span> result(it-><\/span>second.begin(), it-><\/span>second.begin() +<\/span> count); <\/span><\/span> \/\/ 无长度检查导致越界读取 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>利用技术<\/h3> 信息泄露<\/strong>：<\/p> 通过OOB读取泄露虚表地址和chrome基地址<\/li> 计算ROP gadget位置<\/li> <\/ul> <\/li> 堆喷技术<\/strong>：<\/p> 分配大量与RenderFrameHost<\/code>大小相同的vector<\/li> 伪造虚表和ROP链<\/li> <\/ul> <\/li> 利用流程<\/strong>：<\/p> 创建子iframe并获取其RenderFrameHost<\/code>地址<\/li> 将Mojo接口Remote传递给父frame<\/li> 移除子iframe释放RenderFrameHost<\/code><\/li> 通过堆喷占位伪造对象<\/li> 触发虚函数调用实现控制流劫持<\/li> <\/ul> <\/li> <\/ol> 防御措施<\/h2> 正确管理生命周期<\/strong>：<\/p> 使用WebContentsObserver<\/code>等机制跟踪对象生命周期<\/li> 避免保存原始指针<\/li> <\/ul> <\/li> 输入验证<\/strong>：<\/p> 对所有输入参数进行严格验证<\/li> 特别是数组索引和长度参数<\/li> <\/ul> <\/li> 安全编码实践<\/strong>：<\/p> 使用智能指针管理资源<\/li> 最小化接口暴露<\/li> 遵循Chromium安全编码指南<\/li> <\/ul> <\/li> <\/ol> 总结<\/h2> Mojo作为Chromium的核心IPC机制，其安全性直接影响整个浏览器的安全性。开发者需要特别注意：<\/p> 接口生命周期的正确管理<\/li> 跨进程传递对象的所有权转移<\/li> 输入参数的严格验证<\/li> 避免在接口实现中保存原始指针<\/li> <\/ol> 通过分析这些案例，可以更好地理解Mojo接口的安全风险和防御方法。<\/p>

Chrome沙箱逃逸案例研究与PlaidCTF 2020 Mojo漏洞分析<\/h1>

Mojo基础<\/h2>

Mojo简介<\/h3> Mojo是Chromium项目中的进程间通信(IPC)系统，用于在不同进程间传递消息和接口调用。<\/p>

Mojo接口开发流程<\/h2>

Mojo绑定类型<\/h2>

JavaScript绑定API<\/h2>

漏洞案例分析<\/h2>

Mojo简介<\/h3>
Mojo是Chromium项目中的进程间通信(IPC)系统，用于在不同进程间传递消息和接口调用。<\/p>