1877621 - Missing Remote WebGL causing Win32k Lockdown Disable on some VM

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P2)

Description

In bug 1872920 an (alleged) security issue got reported and after talking to reporter it turned out he was using a (unknown, but presumably a VM) configuration where remote WebGL get disabled, causing us to disable win32k lockdown: https://bugzilla.mozilla.org/show_bug.cgi?id=1872920#c8

I can confirm this behavior on an Mac M1, using Parallels: https://paste.rs/ZPeq6.txt

We specifically intended for this not to happen, see e.g.: https://bugzilla.mozilla.org/show_bug.cgi?id=1736605#c6

Code inspection also doesn't reveal why we end up disabling remote WebGL or in what conditions that would happen.

@ahale investigated and found: "When I try to repro, Windows 11 23H2 running in VMware Workstation on Windows 11 23H2, I see IsWebglIsOutOfProcessEnabled: 1 in the Graphics - WebGL 1 Driver WSI Info section and Win32k Lockdown State for Content Process - Win32k Lockdown enabled -- default value is true"

Comment 1

[Gian-Carlo Pascutto [:gcp]]

It looks like this only reproduces with Release builds and not with Nightlies.

Comment 2

[Daniel Veditz [:dveditz]]

Not sure if this is "sec-high, but only some people" or "sec-moderate overall, but sec-high for affected people"

Comment 4

[Daniel Veditz [:dveditz]]

When resolving a security bug that was fixed elsewhere, please don't use DUPLICATE if the other bug is not a security bug or has a lower sec- severity. For tracking please mark it FIXED and add a "depends on" to the bug that fixed it.