1152280 - (CVE-2015-2712) Incorrect asm.js bounds check elimination vulnerability (Firefox 37.0.1)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Dougall Johnson]

Attachment: poc.html

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36

Steps to reproduce:

An out-of-bounds read/write vulnerability exists in Firefox 37.0.1 (32-bit), which is similar to (but distinct from) a recent Pwn2Own vulnerability. This was tested on Windows.

To trigger the vulnerability, an asm.js change-heap function must be defined with a minLengthExclusive of 0xFFFFFFFF. This function is parsed by CheckHeapLengthCondition in AsmJSValidate.cpp, which validates this value, then adds one to it, wrapping the value to zero. This zero is then stored as the module's minHeapLength, allowing heaps of any (otherwise valid) size to be used.

In FoldMaskedArrayIndex, one is subtracted from the minHeapLength, wrapping back to 0xFFFFFFFF, which is assumed to be less than the heap size for bounds checking purposes. This function will then omit bounds checks for masks as large as 0x7FFFFFFF, even though much smaller heaps can be used. This allows asm.js code to read and write past the end of its heap.

To reproduce, see the attached proof of concept.


Actual results:

Arbitrary read/write.


Expected results:

Probably an error or something.

Comment 1

[Luke Wagner [:luke]]

Attachment: fix-change-heap

Arg, that's terrible.  Thanks for reporting!

Approval Request Comment
[Feature/regressing bug #]: bug 965880
[User impact if declined]: security vulnerability
[Describe test coverage new/current, TreeHerder]: simple test in patch
[Risks and why]: very low risk, just adds another validation failure case

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 8589695 [details] [diff] [review]
fix-change-heap

Review of attachment 8589695 [details] [diff] [review]:
-----------------------------------------------------------------

Oh boy.

Comment 3

[Luke Wagner [:luke]]

Comment on attachment 8589695 [details] [diff] [review]
fix-change-heap

[Security approval request comment]
How easily could an exploit be constructed based on the patch?
Fairly easy, if you know what's going on here.

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?
Both the test and patch more or less point to the bug (which is the line after), if you know what to look for.

Which older supported branches are affected by this flaw?
FF35 and up

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?
The same patch should apply to all branches.

How likely is this patch to cause regressions; how much testing does it need?
Very unlikely to cause regressions.

Comment 4

[Al Billings [:abillings - ex-MoCo]]

I assume that this is a sec-critical? I need to get a rating before sec-approval. 

Assuming it is, we'll want Beta and Aurora patches (or noms) as well.

Comment 5

[Luke Wagner [:luke]]

Yes it is.  I requested branch landing approval in comment 1, or do you mean something different?

Comment 6

[Al Billings [:abillings - ex-MoCo]]

Comment on attachment 8589695 [details] [diff] [review]
fix-change-heap

Sec-approval+ and branch approvals (except for release, which doesn't apply since this isn't a chemspill).

Comment 7

[Luke Wagner [:luke]]

Talking to abillings on irc, the current plan is to wait until April 20th to land on trunk (and subsequently branches) to minimize the window between landing and release.

Comment 8

[Dougall Johnson]

Thanks for getting this organised so quickly. The patch looks good to me.

Comment 9

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4c5586081154

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/56a9afb4e741

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/5dc0d44c8dbd

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/f9db65489b24

Comment 13

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/4c5586081154