Closed
Bug 1811559
Opened 3 years ago
Closed 3 years ago
EmitWasmPreBarrierCall doesn't handle valueOffset correctly
Categories
(Core :: JavaScript: WebAssembly, defect, P1)
Core
JavaScript: WebAssembly
Tracking
()
RESOLVED
FIXED
111 Branch
| Tracking | Status | |
|---|---|---|
| firefox-esr102 | --- | unaffected |
| firefox109 | --- | unaffected |
| firefox110 | --- | unaffected |
| firefox111 | --- | fixed |
People
(Reporter: rhunt, Assigned: rhunt)
References
(Regression)
Details
(Keywords: csectype-uaf, regression, sec-high, Whiteboard: [adv-main111-])
Attachments
(1 file)
EmitWasmPreBarrierCall calls the pre-write barrier passing an implicit valueAddr to it. The change in bug 1810090 caused a valueOffset immediate to be added to the function, which is not added to the valueAddr before invoking the pre-write barrier.
Nearly every caller of EmitWasmPreBarrierCall passes valueOffset = 0, except for two:
- GC object write (preffed-off by default)
- Ref-typed stack results for return values, which is not behind any preference. [1]
Marking this security sensitive due to (2).
|
Assignee | |
Comment 1•3 years ago
|
||
EmitPreWriteBarrierCall had an offset parameter added but didn't use
it.
|
||
Updated•3 years ago
|
Keywords: csectype-uaf,
sec-high
|
||
Comment 2•3 years ago
|
||
wasm: Handle offset in EmitPreBarrierCall. r=jseward
https://hg.mozilla.org/integration/autoland/rev/513879a0961eb91b673fcf3068c5874d1b31741f
https://hg.mozilla.org/mozilla-central/rev/513879a0961e
Group: javascript-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → 111 Branch
|
||
Updated•3 years ago
|
Flags: qe-verify-
|
||
Updated•3 years ago
|
Whiteboard: [adv-main111+r]
|
||
Updated•3 years ago
|
|
|
||
Updated•3 years ago
|
Whiteboard: [adv-main111-]
|
|
||
Updated•2 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•