1852649 - (CVE-2023-4863) Out-of-bounds write in BuildHuffmanTable

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P1)

Description

[Andrew McCreight [:mccr8]]

Chromium posted an update today that includes the following:

[$NA][1479274] Critical CVE-2023-4863: Heap buffer overflow in WebP. Reported by Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at The University of Torontoʼs Munk School on 2023-09-06 [...] Google is aware that an exploit for CVE-2023-4863 exists in the wild.

I saw on Twitter that the patch is here and it looks like code we ship.

Based on the Apple reference, I'm guessing this could be the zero day Apple patched recently.

Comment 1

[Andrew McCreight [:mccr8]]

[Tracking Requested - why for this release]: Security vulnerability being exploited in the wild, though probably in Apple or Chrome's products.

Comment 2

[Andrew McCreight [:mccr8]]

RyanVM has a rebased patch.

Comment 3

[Timothy Nikkel (:tnikkel)]

If RyanVM posts the patch I can review tonight.

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Attachment: Bug 1852649 - Cherry-pick upstream libwebp fix.

Backport of:
https://chromium.googlesource.com/webm/libwebp.git/+/2af26267cdfcb63a88e5c74a85927a12d6ca1d76

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Try push (though job ingestion seems backed up tonight...)
https://treeherder.mozilla.org/jobs?repo=try&revision=f1534cbd5c9a741af4d6948cbc5f7c2c145798e7

Comment 6

[Andrew McCreight [:mccr8]]

The Apple issue I was thinking of is CVE-2023-41064 with the description "A buffer overflow issue was addressed with improved memory handling. [...] Processing a maliciously crafted image may lead to arbitrary code execution.". That's consistent with this, but I don't know if it is actually the same thing.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9352586 [details]
Bug 1852649 - Cherry-pick upstream libwebp fix.

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Presumably easily since this was already being exploited in other browsers. Not sure if it'd need a sandbox escape to go with it to do any real damage though?
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Yes
• Which older supported branches are affected by this flaw?: All
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?: Grafts cleanly all the way to ESR102
• How likely is this patch to cause regressions; how much testing does it need?: Unsure. Seems to pass tests on Try.
• Is Android affected?: Yes

Comment 8

[Andrew McCreight [:mccr8]]

Comment on attachment 9352586 [details]
Bug 1852649 - Cherry-pick upstream libwebp fix.

I'm probably not the ideal person to give this sec-approval, but nobody else seems to be around and the trickiest part of it is coordinating the release stuff, which Ryan is on top of.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/80e4521e9b09
Cherry-pick upstream libwebp fix. r=tnikkel, a=RyanVM

Comment 10

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/012efaa3025f

Comment 11

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-release/rev/e245ca2125a6

Comment 12

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/96bd93fca47a (default branch for 115.3esr)

Comment 13

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/2e61ec742c20 (FIREFOX_ESR_115_2_X_RELBRANCH)

Comment 14

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr102/rev/e6d531e48744

Comment 16

[Daniel Veditz [:dveditz]]

Attachment: POC from chrome bug (use ASAN build)

Comment 17

[Ryan VanderMeulen [:RyanVM]]

Attachment: Bug 1852649 - Add crashtest. r=tnikkel

Comment 18

[Frederik Braun [:freddy] (OOO - back August 10th)]

Attachment: advisory.txt

Comment 19

[Frederik Braun [:freddy] (OOO - back August 10th)]

Attachment: advisory.txt

Comment 20

[Christian Holler (:decoder)]

Can we do an analysis of what it takes to hit this with fuzzing and why it might not have been found previously?

Comment 21

[Daniel Bodea [:danibodea]]

I have used the following steps and reproduced a tab crash:

1. Download and open asan build
2. Load the malicious webp image: https://bugzilla.mozilla.org/attachment.cgi?id=9352592
   Actual: Tab crash.
   Expected: Tab does NOT crash.

We have reproduced it on Windows 10 and Ubuntu 20 with Nightly v119.0a1 from 2023-09-11-09-18-54, Beta v118.0b7 asan, Release v117.0.1 build 1 and verified this fix in Nightly v119.0a1 from 2023-09-12-04-12-49, Beta v118.0b8, Release v117.0.1 build 2, ESR v115.2.1esr, ESR v115.3.0esr and ESR v102.15.1esr.
Mac OS asan builds would not run so we could not reproduce or verify on MacOS.

Comment 22

[Tyson Smith [:tsmith]]

(In reply to Christian Holler (:decoder) from comment #20)

Can we do an analysis of what it takes to hit this with fuzzing and why it might not have been found previously?

The existing in-tree fuzzer can "detect" this issue (replaying the test case) but it is unclear why it did not find it. There are more fuzzers in oss-fuzz using multiple engines (afl++, etc) which also failed to find this issue. Given the source of this issue this is could be "by design" or the corpus data is simply insufficient in all cases. We can open another bug for additional analysis if needed.

Comment 23

[BugBot [:suhaib / :marco]]

2 months ago, RyanVM placed a reminder on the bug using the whiteboard tag [reminder-test 2023-12-12] .

RyanVM, please refer to the original comment to better understand the reason for the reminder.

Comment 24

[Andrew McCreight [:mccr8]]

The Chromium bug (in the See Also) is public now.

Comment 25

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/46781343dd7b
Add crashtest. r=tnikkel

Comment 26

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/46781343dd7b