1879093 - (CVE-2024-4764) Firefox crashes with two open Meet tabs and taking my AirPods out

Status: RESOLVED FIXED

(Core :: WebRTC: Audio/Video, defect)

Description

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

STR (require AirPods or possibly similar bluetooth headset):

1. Leave already-paired AirPods in their case
2. Go to https://meet.google.com/
3. Click New Meeting / Start an instant meeting
4. Allow camera and microphone and stay in the lobby
5. Duplicate the tab and repeat step 4 there.
6. Make macOS connect with the AirPods by taking them out of their case

Expected result: No crash

Actual result: Firefox crashes with bp-e86fd0af-cf11-49db-883f-ad3010240206

If it doesn't crash in in step 6, put the airpods back in their case (sometimes crashes then) and repeat step 6.

Comment 1

[Andreas Pehrson [:pehrsons]]

This involving two tabs should mean that we are recreating VoiceProcessingIO AudioUnits on two separate threads in the parent process. The cubeb-coreaudio-rs backend serializes operations per-stream. Maybe if we serialize them on the same thread it won't crash. I have some prior work for this so if I can reproduce I'll see how it helps.

Comment 2

[Andrew McCreight [:mccr8]]

Is this like a use after free then? Or is it being more or less safely caught?

Comment 3

[Andreas Pehrson [:pehrsons]]

Based on the mac crash info in the report, this appears safely caught. But I don't think we can assume all paths from this STR will be safely caught. Adding some more crash signatures that are all from macOS 14.

In particular [@ AudioDSP@0x3ffb34 ] looks dead on like a UAF, and involves tearing down an audio unit. Step 6 in the STR would trigger that code path so might be a related failure mode here.

Comment 4

[Andreas Pehrson [:pehrsons]]

Bug 1880244 might help here, since it will make us create and destroy vpio audio units much less.

Comment 5

[Jim Mathies [:jimm]]

Patches being developed in the parent.

Comment 7

[Jim Mathies [:jimm]]

We're not sure if the parent bug's changes will fully address the crash signature here. Waiting to see as that work rolls out.

Comment 8

[Jim Mathies [:jimm]]

We think this is fixed in 126.

Comment 9

[Jim Mathies [:jimm]]

126 is looking clean. resolving.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Can you clarify the status of ESR115 for this bug given that this is rated sec-high?

Comment 11

[Jesse Schwartzentruber (:truber)]

Attachment: advisory.txt