1280943 - Parent and child HSTS states go out of sync

Status: RESOLVED DUPLICATE of bug 1689191

(Core :: Security: PSM, defect, P3)

Description

[Simon Lindholm]

DataStorage::Init does the following in child processes:

>    InfallibleTArray<DataStorageItem> items; // received from parent
>    for (auto& item : items) {
>      Entry entry;
>      entry.mValue = item.value();
>      PutInternal(item.key(), entry, item.type(), lock); // (+error checking)
>    }

This causes the entries to get default mScore and mLastAccessed values, instead of the proper ones held only by the parent process, which makes the eviction logic behave differently between parent and child.

For instance, an attacker could evict all cached, non-preloaded HSTS entries from the child by adding a few thousand dummy HSTS entries that occur late in the hash table order. From what I read this this isn't really a security problem, though.

Comment 1

[Sylvestre Ledru [:Sylvestre]]

Moving to p3 because no activity for at least 1 year(s).
See https://github.com/mozilla/bug-handling/blob/master/policy/triage-bugzilla.md#how-do-you-triage for more information

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

As of bug 1689191, DataStorage is only used in the main process.