CVE-2022-32792, an out-of-bounds write in Safari, was exploited by Manfred Paul at Pwn2Own. Based on the available patch information, Daniel Lim Wee Soong and Đỗ Minh Tuấn of STAR Labs created a technical write-up. The article starts with a patch analysis of WebKit’s fix, which refines how B3ReduceStrength computes value ranges for sign extension operations. It furthermore dives down the rabbit hole of Just-in-time (JIT) in JavaScriptCore (JSC). The post also pays tribute to the article Project Zero: JITSploitation I: A JIT Bug. The video shows that they managed to open calc with the PoC. Apple shipped the fix on 20 July 2022 in macOS Monterey 12.5, crediting Manfred Paul working with Trend Micro’s Zero Day Initiative.
