1219242 - Startup crash in sboxhost.dll/sboxdll.dll with Dell Protected WorkSpace v5.0.22075

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[[:philipp]]

[Tracking Requested - why for this release]:
This bug was filed from the Socorro interface and is 
report bp-f668b091-a3bc-49a1-83ff-0ea9a2151026.
=============================================================

a number of startup crashes started occurring this week containing involvement of sboxhost.dll/sboxdll.dll modules and they are on the rise:

https://crash-stats.mozilla.com/search/?signature=~sboxdll.dll&signature=~sboxhost.dll&date=%3E2015-01-01&_facets=signature&_facets=uptime&_facets=platform&_facets=user_comments&_facets=version&_facets=useragent_locale&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-version

these libraries are part of the Dell Protected WorkSpace software that sandboxes some popular software like firefox, acrobat etc.
according to an affected user at https://support.mozilla.org/questions/1090992#answer-799103 this software just received an update this week to version v5.0.22075 (matching the file version of the crashing sboxhost.dll module), which i presume causes these crashes.

the startup crashes seem to affect all versions of firefox including 41 and 42beta. maybe we can do some outreach to dell?

Comment 1

[[:philipp]]

for a signature that is just two days old this is triggering an alarmingly unusual amount of questions at sumo already unfortunately.

according to http://www.crn.com/news/security/240157259/invincea-lands-container-deal-on-dell-commercial-laptops.htm this software is preinstalled on millions of dell machines. if the crashy version lands on their base system image, that could mean that firefox crashes "out of the box" on their new hardware, which isn't a particularly nice prospect...

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

The stack suggests some sort of infinite recursion inside sboxhost.dll.

Comment 3

[Mark Schmidt :marksc]

I emailed the firefox-dev list about this. 

The article about having Protected Workspace on 20m computers is worrying. However, it's probably referring to PW v4, which is still supported and may not have the same issue. (An update to v4 was just released today. So let's keep an eye on this.)

On the SUMO side of things, we should be telling these admins/IT people to contact Dell. If a user posts, tell them to contact their admin/helpdesk.

Dell should want to fix this on their end, since this is affecting their customers, and is presumably affecting a large portion of Protected Workspace v5 customers (while only affecting a small portion of Firefox users).

Comment 4

[Mark Schmidt :marksc]

Invincea claims this software is installed on 20m new computers each year. If that's true, we could be looking at 40-60m installations. https://www.invincea.com/2014/01/dell-data-protection-protected-workspace/

The crash to support forum post ratio for this issue is especially troubling. If this problem grows tomorrow, and I expected it to, I'll work on getting a KB article up to deflect some of the support forum traffic ASAP.

Comment 5

[:Gijs (he/him)]

Can we prevent the DLL from being injected into our process given the hooks we have for this on Windows? Kyle, do you know?

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Tracking as it could be a major issue.
Unfortunately, we (relman) don't have any contact with Dell

Comment 7

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

We could attempt to block it, yes.  Ideally we would have a system that this occurs on to test with (either directly, or a user who can be connected to an engineer).

Comment 8

[Mark Schmidt :marksc]

Update from Invincea (developers of Dell Protected Workspace) 

Brad Chiappetta (Invincea Enterprise Support)
Oct 29, 10:41

Hello Mark-

We believe that we have identified what is happening. We have had to make significant changes to our product to support the changes Mozilla has implemented around extensions since FF40, and we believe one of those changes is causing this issue. We are not able to actually reproduce this crash in house, so there must be another variable at play. However, based on the information you have provided, we are going to look into rolling out a low-impact change to the users that we believe will address the issue.


Brad Chiappetta (Invincea Enterprise Support)
Oct 29, 13:17

Good Afternoon Mark-

We were able to test and deliver an update to the Dell Protected Workspace environment to correct this issue. Please ask users to Exit and relaunch Dell Protected Workspace to receive and apply the update.

Comment 9

[Liz Henry (:lizzard) (relman/hg->git project)]

Sounds like this may fix the issue. Do we have anyone who reported the issue in SUMO or to user advocacy who we could contact to verify the fix ?

Comment 10

[Tyler Downer [He/Him]]

Mark may have a contact who can verify this, I don't.

Comment 11

[[:philipp]]

i'll try getting any new users with this issue i come across to confirm that this third-party fix is working. for exisiting users posting about this in the sumo forum we have recommended they uninstall the software alltogether, so it is hard to follow-up with them...
crash stats themselves might also be a way to verify the issue - if we see the signatures declining again and there aren't any more crashes with sboxhost.dll & a file version higher than 5.0.22075 this may be a good sign.

Comment 12

[[:philipp]]

according to https://support.mozilla.org/en-US/questions/1091107 the dell upgrade is successful in solving the crashing issue...

Comment 13

[[:philipp]]

based on feedback of two different users that the crashes stopped after receiving an update pushed by invincea and the stats of these crashes going down to near zero again, i'm changing the state of this report to resolved.