1806974 - AddressSanitizer: heap-use-after-free [@ get] through [@ mozilla::net::Http2Session::RecvGoAway] with READ of size 8

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 20221219-91a9bbbe6bea (non-debug fuzzing ASan build).

For detailed crash information, see attachment.

To reproduce the issue, perform the following steps:

1. Download the attached testcase, save as "test.bin".
   2a. Build with --enable-fuzzing (requires Clang and ASan, also build gtests using ./mach gtest dontruntests).
   2b. Alternatively you can download builds from TC using python -mfuzzfetch -a --fuzzing --target firefox gtest (see https://github.com/MozillaSecurity/fuzzfetch).
2. Run FUZZER=NetworkHttp2ProxyHttp2 objdir/dist/bin/firefox test.bin

I reproduced this locally and it crashes consistently.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Kershaw Chang [:kershaw]]

Attachment: Bug 1806974 - Avoid manipulating the queue inside the loop, r=#necko

Comment 4

[Kershaw Chang [:kershaw]]

Comment on attachment 9309913 [details]
Bug 1806974 - Avoid manipulating the queue inside the loop, r=#necko

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Probably quite easy.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which older supported branches are affected by this flaw?: all
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?: Low, since the behavior is not changed.
• Is Android affected?: Yes

Comment 5

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Comment on attachment 9309913 [details]
Bug 1806974 - Avoid manipulating the queue inside the loop, r=#necko

Approved to land and request uplift

Comment 6

[Kershaw Chang [:kershaw]]

Attachment: Bug 1806974 - Avoid manipulating the queue inside the loop, r=#necko

Original Revision: https://phabricator.services.mozilla.com/D165564

Comment 7

[Kershaw Chang [:kershaw]]

Comment on attachment 9309913 [details]
Bug 1806974 - Avoid manipulating the queue inside the loop, r=#necko

Beta/Release Uplift Approval Request

• User impact if declined: Possible crash due to UAF
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This patch is straightforward and doesn't change the behavior.
• String changes made/needed: N/A
• Is Android affected?: Yes

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration:
• User impact if declined: Possible crash due to UAF
• Fix Landed on Version: 111
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This patch is straightforward and doesn't change the behavior.

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Avoid manipulating the queue inside the loop, r=necko-reviewers,valentin
https://hg.mozilla.org/integration/autoland/rev/39c4e552181d90707621d0cde92401acca2ebde5
https://hg.mozilla.org/mozilla-central/rev/39c4e552181d

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9309913 [details]
Bug 1806974 - Avoid manipulating the queue inside the loop, r=#necko

Approved for 109.0b9.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/08cce5fd97ea

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9309913 [details]
Bug 1806974 - Avoid manipulating the queue inside the loop, r=#necko

Approved for 102.7esr.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/69926147e2c5