Using Hermes’s Quicksort to run Doom: A tale of JavaScript exploitation

This post details the discovery and exploitation of an out-of-bounds (OOB) read vulnerability in Hermes's Quicksort implementation. The vulnerability arises from the interaction between a stable sort implementation that uses an index vector and a custom comparison function that modifies the array during sorting. By extending the array and carefully controlling the comparison function's return values, an attacker can cause the sorting algorithm to access indices beyond the bounds of the index vector, leading to an OOB read. Further investigation revealed that this OOB read could be escalated to arbitrary code execution by manipulating swaps within the Quicksort algorithm, specifically by underflowing the 'j' index and defining a custom getter for the out-of-bounds access. The post demonstrates the exploit by running the game Doom within Hermes.