1481454 - Remove Nightly restriction for blocking threads with LoadLibrary* functions as entry points

Status: RESOLVED FIXED

(Core :: DLL Services, enhancement, P4)

Description

[Carl Corcoran [:ccorcoran]]

It seems time to remove the Nightly restriction for this feature.

Comment 1

[Toshihito Kikuchi [:toshi]]

Attachment: Bug 1481454 - Enable protection against the CreateRemoteThread+LoadLibrary technique in non-Nightly. r=mhowell

Bug 1435816 enabeld this protection in Nightly four years ago. It's time to
expand it to the other release channels.

Bug 1752466 showed WebRoot uses this technique and caused a deadlock in Firefox.
It proved this protection is helpful.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e26783765b37
Enable protection against the CreateRemoteThread+LoadLibrary technique in non-Nightly.  r=mhowell

Comment 3

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/e26783765b37

Comment 4

[Toshihito Kikuchi [:toshi]]

Comment on attachment 9262134 [details]
Bug 1481454 - Enable protection against the CreateRemoteThread+LoadLibrary technique in non-Nightly. r=mhowell

Beta/Release Uplift Approval Request

• User impact if declined: Webroot Secureanywhere may cause deadlock at startup.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): The change is to remove NIGHTLY_BUILD restriction, so landing this on Nightly had no impact. We have run this nightly-only code for four years (since bug 1435816) and no regression was reported. I set the risk to Medium because this change might impact valid third-party applications that are mainly installed with Beta or Release version. Without uplifting this, however, we cannot evaluate such impact.
• String changes made/needed: None

Comment 5

[Pascal Chevrel:pascalc]

Comment on attachment 9262134 [details]
Bug 1481454 - Enable protection against the CreateRemoteThread+LoadLibrary technique in non-Nightly. r=mhowell

This landed in 98 nightly which goes into beta tomorrow, so no need to uplift to beta.

Comment 6

[Pascal Chevrel:pascalc]

Toshi, this patch had never been on beta before, I think it would be good to keep it behind the early_beta_or_earlier flag.

Comment 7

[Toshihito Kikuchi [:toshi]]

Ok, let's reopen this. I'll upload a patch to add EARLY_BETA_OR_EARLIER.

Comment 8

[Toshihito Kikuchi [:toshi]]

Attachment: Bug 1481454 - Restrict the LoadLibrary injection protection to early beta. r=mhowell

This protection may be too risky to be enabled unconditionally.

Comment 9

[Pascal Chevrel:pascalc]

(In reply to Toshihito Kikuchi [:toshi] from comment #7)

Ok, let's reopen this. I'll upload a patch to add EARLY_BETA_OR_EARLIER.

Thanks, please request an uplift to beta once this has landed.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8ca70e015f3b
Restrict the LoadLibrary injection protection to early beta.  r=mhowell

Comment 11

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/8ca70e015f3b

Comment 12

[Toshihito Kikuchi [:toshi]]

Comment on attachment 9263110 [details]
Bug 1481454 - Restrict the LoadLibrary injection protection to early beta. r=mhowell

Beta/Release Uplift Approval Request

• User impact if declined: The earlier patch, preventing the LoadLibrary injection, may cause compat issues, so it's risky to enable it unconditionally. This patch limits it to early beta and earlier.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): We used to have the NIGHTLY_BUILD check. This patch replaces it with EARLY_BETA_OR_EARLIER.
• String changes made/needed: None

Comment 13

[Pascal Chevrel:pascalc]

Comment on attachment 9263110 [details]
Bug 1481454 - Restrict the LoadLibrary injection protection to early beta. r=mhowell

Approved for 98 beta 3, thanks!

Comment 14

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/b0ce88a8d1cb

Comment 15

[Ryan VanderMeulen [:RyanVM]]

Do we have a bug on file for letting this ride the trains eventually?

Comment 16

[Toshihito Kikuchi [:toshi]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #15)

Do we have a bug on file for letting this ride the trains eventually?

Filed a new one. Thank you for the reminder!