1407027 - (CVE-2017-5095) pdfium Buffer Overflow

Status: RESOLVED FIXED

(Core :: Printing: Output, defect, P3)

Description

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

See https://bugs.chromium.org/p/chromium/issues/detail?id=732661

We have this code: http://searchfox.org/mozilla-central/source/modules/pdfium/pdfium/fpdfsdk/fpdf_flatten.cpp#310

Comment 1

[Daniel Veditz [:dveditz]]

The Chrome team assigned CVE-2017-5095 to this bug, and since we've just incorporated their library we should reference the same one. Looks like this landed in Firefox 56 (bug 1368948) though I don't know whether it was enabled right away. Changing component to match bug 1368948

Is pdfium only used for printing the previous bug suggests? If so we can probably lower the severity to sec-high since it couldn't be exploited just by browsing a malicious page.

Comment 2

[Daniel Veditz [:dveditz]]

:brsun doesn't seem to be around. Who should shepherd this fix in?

Comment 3

[Jonathan Watt [:jwatt]]

We're not exposing users to PDFium at all since we haven't yet flipped the pref pdfium.enabled.

This does raise the question of whether or not we can get access to PDFium sec bugs that're reported against chromium before they're released though. Do we have anyone with access?

Comment 4

[Jonathan Watt [:jwatt]]

(In reply to Jonathan Watt [:jwatt] (needinfo? me) from comment #3)
> we haven't yet flipped the pref pdfium.enabled.

Err, wrong pref. It's the hidden pref print.print_via_pdf_encoder that needs to be set to 'skia-pdf' (we don't currently ship that). Also that pref only works if mozilla is built with --enable-skia-pdf, which is currently only the case for Nightly. Anyway, regardless of the mechanism, we don't currently expose users to PDFium.

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

OK, sounds like I can mark 56/57 as unaffected since we shipped 56 with the pref off and with a specific build. So only 58 should be currently affected even with the pref enabled. 

dveditz, does that sound right?

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to Jonathan Watt [:jwatt] (needinfo? me) from comment #3)
> We're not exposing users to PDFium at all since we haven't yet flipped the pref

Great, thanks. I'll mark the current releases "not tracking" and "disabled".

> This does raise the question of whether or not we can get access to PDFium
> sec bugs that're reported against chromium before they're released though.
> Do we have anyone with access?

If I know what to look for I can query for bugs a little before they're released (when they get the label Restrict-View-SecurityNotify).

Comment 7

[Frederik Braun [:freddy]]

(In reply to Jonathan Watt [:jwatt] (needinfo? me) from comment #4)
> (In reply to Jonathan Watt [:jwatt] (needinfo? me) from comment #3)
> > we haven't yet flipped the pref pdfium.enabled.
> 
> Err, wrong pref. It's the hidden pref print.print_via_pdf_encoder that needs
> to be set to 'skia-pdf' (we don't currently ship that). Also that pref only
> works if mozilla is built with --enable-skia-pdf, which is currently only
> the case for Nightly. Anyway, regardless of the mechanism, we don't
> currently expose users to PDFium.

Seems like this is still disabled. Hooray.
Do you have any plans to change that?
Either way, can you update the tracking flags accordingly for us?

Thank you!

Comment 8

[Jonathan Watt [:jwatt]]

(In reply to Frederik Braun [:freddyb] from comment #7)
> Seems like this is still disabled. Hooray.
> Do you have any plans to change that?

No. Future layout plans are being worked on, but not in the near term.

Comment 9

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Just wanted to note that I ran a script on pdfium since our last update. 2419 commits and it found the following:

Summary
-----------------
Bugtracker: Restricted Bug : 35 issues identified
Bugtracker Keyword: Security_Severity-High: 30 issues identified
Commit Message Keyword: overflow: 28 issues identified
Bugtracker Keyword: Security_Severity-Medium: 23 issues identified
Commit Message Keyword: fuzz: 21 issues identified
Commit Message Keyword: crash: 18 issues identified
Commit Message Keyword: ASAN: 7 issues identified
Bugtracker Keyword: Security_Impact: 6 issues identified
Commit Message Keyword: MSAN: 4 issues identified
Bugtracker Keyword: Security_Severity-Low: 2 issues identified
Bugtracker Keyword: CVE-: 1 issues identified
Commit Message Keyword: security: 1 issues identified
Total: 176

Comment 10

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

I'm going to use this bug to track pdfium version updates. Depending on how often they roll pdfium, I may not keep commenting since AIUI pdfium is sitting for a bit until we decide to start using it for stuff.

Update pdfium to 3ae75c2f2e5759fcf8218e59fa380c26b98aa6b6
---------
Whiteboard: [third-party-lib-audit]
Most Recent: 1346291
---------
This is a (semi-)automated bug making you aware that there is an available upgrade for an embedded third-party library. You can leave this bug open, and it will be updated if a newer version of the library becomes available. If you close it as WONTFIX, please indicate if you do not wish to receive any future bugs upon new releases of the library.

pdfium is currently at version 84213b529908d2b9095ad4c33ecc9fdf5d881df5 in mozilla-central, and the latest version of the library released is 3ae75c2f2e5759fcf8218e59fa380c26b98aa6b6.

I fetched the latest version of the library from https://chromium.googlesource.com/chromium/src/+/master/DEPS.

(Technically, this 'latest commit' is not a release, but Chromium has rolled their dependency of pdfium.)

Comment 11

[Mats Palmgren (inactive)]

(In reply to Jonathan Watt [:jwatt] from comment #8)
> (In reply to Frederik Braun [:freddyb] from comment #7)
> > Seems like this is still disabled. Hooray.
> > Do you have any plans to change that?
> 
> No. Future layout plans are being worked on, but not in the near term.

If we're not actively working on this, and we're lagging behind on
updating the third-party libraries to secure versions, then I suggest
we simply remove the --enable-skia-pdf from the Nightly build config
until we actually intend to ship that.  It seems better that Nightly
tests the config we actually ship, for now.

Does that sound reasonable?

Comment 12

[Jonathan Watt [:jwatt]]

We already did that for Windows (the only platform that PDFium can build for) in bug 1435230.

Comment 13

[Mats Palmgren (inactive)]

OK, great!  Then I don't see any reason to keep this bug since
the security issue has been solved.

Tom, please file new bug(s) for future PDFium uplifts as needed.