1328840 - [@ mozilla::dom::icc::PIccRequestChild::DestroySubtree ]

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[Dhiraj Mishra]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
Build ID: 20161208153507

Steps to reproduce:

Crash ID : bp-2a1e12fd-9f48-4fb2-8996-ee83d2170105
https://crash-stats.mozilla.com/report/index/2a1e12fd-9f48-4fb2-8996-ee83d2170105

Name 	Firefox
Version 	50.1.0
Build ID 	20161208153507
Update History 	
Update Channel 	release
User Agent 	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
OS 	Windows_NT 6.1

Comment 1

[:Gijs (he/him)]

Can you provide steps to reproduce?

Comment 2

[Dhiraj Mishra]

I just simply open Mozilla where it got crash and generated a crash ID.
Me to figuring it out :D

Comment 3

[Daniel Veditz [:dveditz]]

UAF in interprocess communication, looks like.

Comment 4

[Daniel Veditz [:dveditz]]

this crash signature first appears on Dec 13, regression from something? That's when we released 50.1 so it could be unique to security fixes in that release.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

David, does this look like anything to you?

Comment 6

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

It looks like this code (dom/icc) was removed in bug 1310864 as of Firefox 52, and it seems to have been for exposing SIM cards to privileged script on B2G (bug 744714 and https://developer.mozilla.org/en-US/docs/Mozilla/B2G_OS/API/MozIccManager).

Comment 7

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

…except that doesn't make sense, because even if there were some way to activate that code on desktop, it wouldn't be a subactor of a PImageBridge.  Maybe this is a case where the linker merged bitwise-identical functions and the crash processor doesn't know enough to pick the right name.

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

It looks like ImageBridge is trying to destroy an actor that's already freed. ImageBridge had lots of race conditions, especially related to shutdown, that we fixed with a big refactoring in Firefox 51. bug 1298938 was where a lot of this happened. We've seen other sec bugs and top crashes go away after that landed, and this bug appears to be Firefox 50 only.

Comment 9

[Daniel Veditz [:dveditz]]

If both the free and the re-use happen during a shutdown process it would be pretty hard to exploit. Given that it's gotten fixed in Firefox 51 we don't need to fix it only for 50.1 since we're shipping 51 in two weeks anyway.