1649485 - Crash in [@ ffm64.dll | SymCryptRngAesGenerate]

Status: NEW

(External Software Affecting Firefox :: Other, defect, P3)

Description

[Alex Chronopoulos [:achronop]]

This bug is for crash report bp-060a4985-35e7-4eb6-bfd8-2cdff0200629.

Top 7 frames of crashing thread:

0 ffm64.dll ffm64.dll@0xe79b 
1 ffm64.dll ffm64.dll@0xde20 
2 ffm64.dll ffm64.dll@0x6786f 
3 ffm64.dll ffm64.dll@0x67977 
4 bcryptprimitives.dll SymCryptRngAesGenerate 
5 bcryptprimitives.dll AesRNGState_generate 
6 bcryptprimitives.dll ProcessPrng 

Not sure about the component, feel free to redirect.

Comment 1

[J.C. Jones [:jcj] (he/him)]

ffm64.dll is from Symantec, and bcryptprimitives.dll from Windows. This might well be DLL injection into Firefox, though I thought that was shut off in 2019. Moving into core:security for more eyes

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:dveditz, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[Daniel Veditz [:dveditz]]

ffm64.dll is not explicitly listed in the mozglue dll blocklist I know about. I don't think we block all .dlls, and apparently ffm64.dll crashes enough that it was added to the signature skiplist. Moving to mozglue in case we do want to block it. Asking Aaron about the "is this evading a block" question.

Although the signatures are older they were at a very low rate in Release. There's a spike in Nightly crashes starting at the tail end of 79.0a1 (June 23-25) that might be something we introduced. If it were a Symantec update I'd expect it to hit a lot more versions. If that is true this this wouldn't be a dll blocklisting problem but trying to figure out what else we changed around then. Although in the end, the solution might be blocklisting if it's going to cause a stability issue.

Comment 4

[Toshihito Kikuchi [:toshi]]

We used to block ffm64.dll in the sandbox process, but it was unblocked by bug 1441801, discontinuing Chromium's DLL blocking. Blocking this the content process again with our current blocklist is less risky. Before doing that, however, I'll post a thread in our discussion group with Symantec.

Comment 5

[Toshihito Kikuchi [:toshi]]

I sent an email about this bug to the mozilla-symantec-discuss discussion group on Jul 16 and received an acknowledging receipt from Broadcom.