1902307 - (CVE-2024-7519) out-of-bound access in ShmemTextureReadLock::ReadUnlock

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[dalmurino]

Attachment: patch.diff

In |ReadUnlock()|, |mShmemSection|'s memory region is accessed without validation of offset1. An attacker can achieve an out of bound decrement using this vulnerability. It can manipulate the field of adjacent objects (e.g., length, Reference count, etc.) and there are already many public exploits related to this.

I attempted to get ASAN report but sadly, it didn't work. I guess that ASAN doesn't recognize |PR_ATOMIC_DECREMENT| macro. Therefore, I explain out of bound decrement with a callstack and some logs.
With the attached file, you can see that |info->readCount|, the argument of |PR_ATOMIC_DECREMENT|, is out of the memory region of |mShmemSection| and the destination is in another memory region.

Besides |ReadUnlock()|, the constructors of |ReadLock|, |GetReadCount| and |ShmemTextureReadLock| also have a similar pattern. Though I've only found the way to |ReadUnlock()|, I suggest adding some checks for the offset.

REPRODUCTION CASE
Type of vulnerbility: GPU Process

To reproduce crash, please follow these steps:
Apply patch.diff
Open https://webrtc.github.io/samples/src/content/capture/video-pc/ in browser
// patch.diff emulates a compromised content process

Even if running this Poc on the ASAN build, it is unlikely that a crash or ASAN report will occur. I recommend using a debugger to identify the point where the vulnerability occurs.

Comment 1

[dalmurino]

Attachment: readme.txt

Comment 2

[Frederik Braun [:freddy]]

I think this qualifies as a sandbox escape.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:bhood, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Nicolas Silva [:nical]]

Attachment: Bug 1902307 - Better validate shm sections. r=#gfx-reviewers

Comment 5

[Nicolas Silva [:nical]]

Comment on attachment 9410512 [details]
Bug 1902307 - Better validate shm sections. r=#gfx-reviewers

Security Approval Request

• How easily could an exploit be constructed based on the patch?: The attacker needs to compromise the content process first. See comment 0 for more details about what the attacker could do then.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: all of them
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: No
• If not, how different, hard to create, and risky will they be?: The patch applied and builds on beta and central
• How likely is this patch to cause regressions; how much testing does it need?: Unlikely
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 6

[Nicolas Silva [:nical]]

Comment on attachment 9410512 [details]
Bug 1902307 - Better validate shm sections. r=#gfx-reviewers

Beta/Release Uplift Approval Request

• User impact if declined: Security vulnerability
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): It is a rather simple change where we use two separate types to represent the untrusted and the validated version of something with simple validation between the two.
• String changes made/needed: None
• Is Android affected?: Yes

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 9410512 [details]
Bug 1902307 - Better validate shm sections. r=#gfx-reviewers

sec-approval+ = dveditz, and a+ for early beta uplift.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/23d2c44dbc20
Better validate shm sections. r=gfx-reviewers,lsalzman

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/23d2c44dbc20

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/releases/mozilla-beta/rev/483295097353
Better validate shm sections. r=gfx-reviewers,lsalzman, r=dmeehan

Comment 11

[Donal Meehan [:dmeehan]]

Comment on attachment 9410512 [details]
Bug 1902307 - Better validate shm sections. r=#gfx-reviewers

Approved for 115.14esr

Comment 12

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/0288d0ce41f9

Comment 13

[Donal Meehan [:dmeehan]]

Comment on attachment 9410512 [details]
Bug 1902307 - Better validate shm sections. r=#gfx-reviewers

Approved for 128.1esr.

Comment 14

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/053d9a9fa4be

Comment 15

[Tyson Smith [:tsmith]]

Attachment: advisory.txt