JIT spraying is a class of computer security exploit that circumvents the protection of address space randomization (ASLR) and data execution prevention (DEP) by exploiting the behavior of just-in-time compilation. It has been reported to have been used to penetrate security features in the PDF format  and Adobe's Flash technology.
A just-in-time compiler (JIT) by definition produces code as its data. Since the purpose is to produce executable data, a JIT compiler is one of the few types of programs that cannot be run in a no-executable-data environment. Because of this, JIT compilers are normally exempt from data execution prevention. A JIT spray attack does heap spraying with the generated code.
var a = (0x11223344^0x44332211^0x44332211^ ...);
JIT then will transform bytecode to native x86 code like:
0: b8 44 33 22 11 mov $0x11223344,%eax mov eax,0x11223344 5: 35 11 22 33 44 xor $0x44332211,%eax xor eax,0x44332211 a: 35 11 22 33 44 xor $0x44332211,%eax xor eax,0x44332211
The attacker then uses a suitable bug to redirect code execution into the newly generated code. For example, a buffer overflow or use after free bug could allow the attack to modify a function pointer or return address.
This causes the CPU to execute instructions in a way that was unintended by the JIT authors. The attacker is usually not even limited to the expected instruction boundaries; it is possible to jump into the middle of an intended instruction to have the CPU interpret it as something else. As with non-JIT ROP attacks, this may be enough operations to usefully take control of the computer. Continuing the above example, jumping to the second byte of the "mov" instruction results in an "inc" instruction:
1: 44 inc %esp inc esp 2: 33 22 xor (%edx),%esp xor esp,DWORD PTR [edx] 4: 11 35 11 22 33 44 adc %esi,0x44332211 adc DWORD PTR ds:0x44332211,esi a: 35 11 22 33 44 xor $0x44332211,%eax xor eax,0x44332211
Computer hardware that allows jumping into the middle of an instruction includes x86, x86-64, and ARM. Although especially effective on this type of hardware, JIT spraying works on other systems as well.
To protect against JIT spraying, the JIT code can be disabled or made less predictable for the attacker.
- Jürgen Schmidt (20 January 2011). "Return of the sprayer -- JIT Spraying: Exploits to beat DEP and ASLR". The H. Retrieved 22 January 2011.
- Haifei Li (10 February 2010). "JIT Spraying in PDF". Fortinet blog. Retrieved 22 January 2011.
- Larry Seltzer (4 February 2010). "New "JIT Spray" Penetrates Best Windows Defenses". PCmag.com. Retrieved 22 January 2011.
- Dion Blazakis. "Interpreter Exploitation. Pointer Inference and JIT Spraying" (PDF). Black Hat & Defcon 2010.; "Slides" (PDF).
- Writing JIT-Spray Shellcode for fun and profit, Alexey Sintsov, (pdf)
|This computer security article is a stub. You can help Wikipedia by expanding it.|