1668514 - (CVE-2020-15254) Update crossbeam-channel.

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[Emilio Cobos Álvarez (:emilio)]

I don't know if this can be causing issues for our users, see incoming patch.

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1668514 - Update crossbeam-channel. r=jrmuizel,janerik

It's used by both webrender and fog, and it contains a subtle soundness
issue which may affect us, see:

• https://github.com/crossbeam-rs/crossbeam/pull/533
• https://twitter.com/khuey_/status/1311641831201857537

Quoting for posterity:

There is a 0.4.4 on a branch and it contains a reversion for the UB
mentioned in https://github.com/crossbeam-rs/crossbeam/pull/533.

This was causing corruption of jemalloc structures (and ultimately a
deadlock) for us.

Update the crate resolving the issue.

Comment 2

[Frederik Braun [:freddy]]

I've been looking at the patch, the conversations on Twitter / GitHub and talked to Emilio on Slack.
It looks like there are no obvious pointers for how to turn that into a crash (or even an exploit).
The risk if this was exploited is sec-high (memory corruption), but I can hardly see us 0day ourselves here.
I'd suggest rating this sec-high as a precaution but also allowing for speedy sec-approval.

Tom, would you agree?

Comment 3

[Tom Ritter [:tjr]]

Your analysis sounds reasonable, I don't want to hold this up, so I'll defer to you =)

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 9178973 [details]
Bug 1668514 - Update crossbeam-channel. r=jrmuizel,janerik

Security Approval Request

• How easily could an exploit be constructed based on the patch?: pretty hard, it's not clear if possible even.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Yes
• Which older supported branches are affected by this flaw?: 81,82
• If not all supported branches, which bug introduced the flaw?: Bug 1648405
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?: Trivial, not risky.
• How likely is this patch to cause regressions; how much testing does it need?: not very risky.

Beta/Release Uplift Approval Request

• User impact if declined: Potential weird crashes (unclear if possible)
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: none
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Simple dependency update to fix UB that can end up in memory corruption in some cases.
• String changes made/needed: none

Comment 5

[Frederik Braun [:freddy]]

(In reply to Frederik Braun [:freddy] from comment #2)

...
I'd suggest rating this sec-high as a precaution but also allowing for speedy sec-approval.

I set the wrong flag, oops.

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Ping for sec-approval?

Comment 7

[Tom Ritter [:tjr]]

Comment on attachment 9178973 [details]
Bug 1668514 - Update crossbeam-channel. r=jrmuizel,janerik

Approved, sorry

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/a853e285286d8d273b7bde64dcdca92474ce21c6
https://hg.mozilla.org/mozilla-central/rev/a853e285286d

Comment 9

[Julien Cristau [:jcristau]]

Comment on attachment 9178973 [details]
Bug 1668514 - Update crossbeam-channel. r=jrmuizel,janerik

approved for 82.0b9

Comment 10

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-beta/rev/b42aa432d541

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.

Comment 12

[Emilio Cobos Álvarez (:emilio)]

Done!

Comment 13

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Mostly copied their advisory, cleaned up grammar.

Comment 14

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 15

[Daniel Veditz [:dveditz]]

https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-v5m7-53cv-f3hx
https://github.com/RustSec/advisory-db/blob/master/crates/crossbeam-channel/RUSTSEC-2020-0052.md