1736230 - UAF Crash in [@ RtlDeleteCriticalSection | sofree | mozilla::DataChannelConnection::DestroyOnSTS]

Status: RESOLVED INCOMPLETE

(Core :: WebRTC, defect)

Description

[Randell Jesup [:jesup] (needinfo me)]

UAF when trying to free an sctp connection socket; crashes trying to release a critical section.

Crash report: https://crash-stats.mozilla.org/report/index/3f1723b7-0215-41c3-84eb-0cad30211011

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 ntdll.dll RtlDeleteCriticalSection 
1 xul.dll sofree netwerk/sctp/src/user_socket.c:287
2 xul.dll mozilla::DataChannelConnection::DestroyOnSTS netwerk/sctp/datachannel/DataChannel.cpp:410
3 xul.dll mozilla::runnable_args_memfn<RefPtr<mozilla::DataChannelConnection>, void  dom/media/webrtc/transport/runnable_utils.h:121
4 xul.dll mozilla::detail::runnable_args_base<mozilla::detail::NoResult>::Run dom/media/webrtc/transport/runnable_utils.h:41
5 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1142
6 xul.dll mozilla::net::nsSocketTransportService::Run netwerk/base/nsSocketTransportService2.cpp:1190
7 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1142
8 xul.dll mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:300
9 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:324

Comment 1

[Michael Tüxen]

I think I have a reproducer for this issue. Need to find time to fix the issue...

Comment 2

[Jim Mathies [:jimm]]

Hey Michael, please let us know when you have a fix. Thanks!

Comment 3

[Michael Tüxen]

Will do.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field for this bug is set to S3. However, the bug is flagged with the sec-high keyword.
:mjf, could you consider increasing the severity of this security bug?

For more information, please visit auto_nag documentation.

Comment 5

[Michael Froman [:mjf]]

This bug is already marked stalled, and recently moved from s2 to s3. There is no real action to take here.

Comment 6

[Tom Ritter [:tjr]]

Extremely low crash rate, and hopefully fixed since the two crashes present are on 99 and 102.15 ESR

Comment 7

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit BugBot documentation.