1156769 - A web page can easily bring down the x server by creating large canvases (or many small ones) on Linux

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Nicolas Silva [:nical]]

Allocating xlib surfaces creates memory that belongs to the x server. If we create many of them and run out of memory, the x server is killed by the low memory killer along with the desktop and all open applications rather than just firefox. It's trivial to have a page create a bunch of very large canvases and see the x server getting killed instead of the firefox process, and this seems pretty bad.

We could do what we do on firefox OS and have all xlib allocations be made by a dedicated thread (in the compositor process with e10s), which ensures that we don't do too many allocations. I suppose it's the best solution as far as security is concerned, though it has a performance penalty.

we could mitigate the issue by restricting the content thread to a maximum memory budget for canvases and video, and disallow unreasonable sizes for these elements individually (though a compromised content process would still be able to do some damage). Thoughts?

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

To be explicit, why is killing the X server a security risk?

Comment 2

[Bas Schouten (:bas.schouten)]

I'm also unclear as to why this would be security sensitive.

Comment 3

[Bas Schouten (:bas.schouten)]

Actually, my apologies, I suppose I see why it's annoying and could be considered a DOS to lose your x-server. But I feel it's less bad than bringing down an entire machine I suppose.

Comment 4

[Nicolas Silva [:nical]]

Fixed by disabling xrender.