Closed Bug 1938184 Opened 1 year ago Closed 1 year ago

Mac OS X Firefox WebGL shader OOB read in gleRunVertexSubmitImmediate

Categories

(Core :: Graphics: CanvasWebGL, defect)

Product:
Core
Component:
Graphics: CanvasWebGL
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1937097

People

(Reporter: pore45214, Unassigned)

References

Details

(Keywords: csectype-bounds, reporter-external, sec-high, Whiteboard: [client-bounty-form])

Attachments

(1 file)

crash.html
4.85 KB, text/html
Details
Attached file crash.html —

Steps to reproduce the problem

OS : MacOS Sequoia 15.2 [Macbook Intel UH Graphics 630]
Version : Firefox 135.0a1

  1. run Firefox on Mac OS X
  2. open crash.html
  3. it crashed

Vulnerability

When running the attached crash.html file on Firefox, a controllable OOB Read Vulnerability occurs.
Before running the drawArrays function of webgl, if you run the vertexAttribI4ui function and manipulate the second parameter (first) of drawArrays, you receive the manipulated value as an address and dereferer to that address, which causes a crash.

  • GLEngine:x86_64+0x11f5ae
case 5:                       // crash case
                    si128 = (__m128d)_mm_load_si128((const __m128i *)&xmmword_7FFB039C1AC0);
                    v127 = _mm_cvtpd_ps(
                             _mm_sub_pd(
                               (__m128d)_mm_or_si128(_mm_cvtepu32_epi64(*(__m64 *)v57->i8), (__m128i)si128), // [1]
                               si128));
                    a7 = 0LL;
                    a7.f32[0] = (float)v57->i32[2];
                    if ( v31 == 4 )
                    {
                      v20.f32[0] = (float)v57->i32[3];
                      a11 = _mm_insert_ps(_mm_insert_ps(v127, a7, 32), v20, 48);
                      v20 = (__m128)0xBF800000;
                    }
                    else
                    {
                      a11 = _mm_insert_ps(v127, a7, 40);
                    }
                    LODWORD(v32) = 5;
                    break;

__text:00007FFB039775AE                 pmovzxdq xmm0, qword ptr [rax] ; jumptable 00007FFB03976DE2 case 5 // crashed point
__text:00007FFB039775B3                 movdqa  xmm2, cs:xmmword_7FFB039C1AC0
__text:00007FFB039775BB                 por     xmm0, xmm2
__text:00007FFB039775BF                 subpd   xmm0, xmm2
__text:00007FFB039775C3                 cvtpd2ps xmm4, xmm0
__text:00007FFB039775C7                 mov     ecx, [rax+8]
__text:00007FFB039775CA                 xorps   xmm0, xmm0
__text:00007FFB039775CD                 cvtsi2ss xmm0, rcx
__text:00007FFB039775D2                 cmp     r12d, 4
__text:00007FFB039775D6                 jnz     loc_7FFB039778A1
__text:00007FFB039775DC                 mov     eax, [rax+0Ch]
__text:00007FFB039775DF                 cvtsi2ss xmm1, rax
__text:00007FFB039775E4                 insertps xmm4, xmm0, 20h ; ' '
__text:00007FFB039775EA                 insertps xmm4, xmm1, 30h ; '0'
__text:00007FFB039775F0                 movss   xmm1, cs:dword_7FFB039C1B84
__text:00007FFB039775F8                 mov     r11d, 5
__text:00007FFB039775FE                 jmp     def_7FFB03975E61
  • When running [1], the second parameter (first) value of drawArrays is (__m64 *)v57->i8, which causes a crash when it is dereferenced without any verification.
  • This is more evident in the assembly, where the value 0x83828180 is stored in the rax register, received as an address, and then dereferenced.
  • In the attached log, it's in debug build, but it's actually crashing in Firefox and Firefox Nightly as well.

ASAN log

==97205==ERROR: AddressSanitizer: SEGV on unknown address 0x000083828180 (pc 0x7ffb121895ae bp 0x700007431800 sp 0x700007431690 T53)
==97205==The signal is caused by a READ memory access.
[Parent 97205, Main Thread] WARNING: Forced to copy ObserverTable due to nested notifications: file /Users/GF/mozilla-unified/image/ProgressTracker.h:85
    #0 0x7ffb121895ae in gleRunVertexSubmitImmediate+0x20be (GLEngine:x86_64+0x11f5ae)
    #1 0x7ffb1211f78a in gleDrawArraysOrElements_ExecCore+0x290 (GLEngine:x86_64+0xb578a)
    #2 0x7ffb12115403 in glDrawArraysInstanced_STD_GL3Exec+0x248 (GLEngine:x86_64+0xab403)
    #3 0x7ffb12114ea8 in glDrawArrays_UnpackThread+0x20 (GLEngine:x86_64+0xaaea8)
    #4 0x7ffb1213d809 in gleCmdProcessor+0x4f (GLEngine:x86_64+0xd3809)
    #5 0x00010716c141 in asan_dispatch_call_block_and_release+0xf1 (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x52141)
    #6 0x7ff80eab67e1 in _dispatch_client_callout+0x7 (libdispatch.dylib:x86_64+0x37e1)
    #7 0x7ff80eac3a2b in _dispatch_lane_barrier_sync_invoke_and_complete+0x3b (libdispatch.dylib:x86_64+0x10a2b)
    #8 0x00010716c411 in dispatch_sync_f+0x121 (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x52411)
    #9 0x7ffb120bc97e in glFinish_ExecThread+0xe (GLEngine:x86_64+0x5297e)
    #10 0x000141b53bb3 in mozilla::gl::GLContext::AfterGLCall_Debug(char const*) const+0x113 (XUL:x86_64+0x495cbb3)
    #11 0x000146b24449 in mozilla::gl::GLContext::fDrawArraysInstanced(unsigned int, int, int, int)+0x149 (XUL:x86_64+0x992d449)
    #12 0x000146b21661 in mozilla::WebGLContext::DrawArraysInstanced(unsigned int, int, int, int)+0xab1 (XUL:x86_64+0x992a661)
    #13 0x000146bcc6ca in auto bool (*mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 103ul, void (mozilla::HostWebGLContext::*)(unsigned int, int, int, int) const, &mozilla::HostWebGLContext::DrawArraysInstanced(unsigned int, int, int, int) const>::DispatchCommandFuncById<mozilla::HostWebGLContext>(unsigned long))(mozilla::HostWebGLContext&, mozilla::webgl::RangeConsumerView&)::'lambda'(mozilla::HostWebGLContext&, mozilla::webgl::RangeConsumerView&)::operator()(mozilla::HostWebGLContext&, mozilla::webgl::RangeConsumerView&) const::'lambda'(auto&...)::operator()<unsigned int, int, int, int>(auto&...) const+0x1ea (XUL:x86_64+0x99d56ca)
    #14 0x000146bcc458 in bool (*mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 103ul, void (mozilla::HostWebGLContext::*)(unsigned int, int, int, int) const, &mozilla::HostWebGLContext::DrawArraysInstanced(unsigned int, int, int, int) const>::DispatchCommandFuncById<mozilla::HostWebGLContext>(unsigned long))(mozilla::HostWebGLContext&, mozilla::webgl::RangeConsumerView&)::'lambda'(mozilla::HostWebGLContext&, mozilla::webgl::RangeConsumerView&)::__invoke(mozilla::HostWebGLContext&, mozilla::webgl::RangeConsumerView&)+0x128 (XUL:x86_64+0x99d5458)
    #15 0x000146ba3441 in mozilla::dom::WebGLParent::RecvDispatchCommands(mozilla::ipc::BigBuffer&&, unsigned long long)+0x5f1 (XUL:x86_64+0x99ac441)
    #16 0x0001470736ef in mozilla::dom::PWebGLParent::OnMessageReceived(IPC::Message const&)+0x135f (XUL:x86_64+0x9e7c6ef)
    #17 0x0001428c32cb in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&)+0x64b (XUL:x86_64+0x56cc2cb)
    #18 0x000140b15bd5 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)+0x385 (XUL:x86_64+0x391ebd5)
    #19 0x000140b0f5ed in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>)+0x59d (XUL:x86_64+0x39185ed)
    #20 0x000140b10e4c in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)+0x48c (XUL:x86_64+0x3919e4c)
    #21 0x000140b133f9 in mozilla::ipc::MessageChannel::MessageTask::Run()+0x1e9 (XUL:x86_64+0x391c3f9)
    #22 0x00013efb2274 in nsThread::ProcessNextEvent(bool, bool*)+0xfd4 (XUL:x86_64+0x1dbb274)
    #23 0x00013efc2603 in NS_ProcessNextEvent(nsIThread*, bool)+0x123 (XUL:x86_64+0x1dcb603)
    #24 0x000140b229d9 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)+0x369 (XUL:x86_64+0x392b9d9)
    #25 0x0001409a31c6 in MessageLoop::Run()+0x116 (XUL:x86_64+0x37ac1c6)
    #26 0x00013efa65db in nsThread::ThreadFunc(void*)+0x3ab (XUL:x86_64+0x1daf5db)
    #27 0x00010a3b6e7c in _pt_root+0x3bc (libnss3.dylib:x86_64+0x495e7c)
    #28 0x00010716a556 in asan_thread_start(void*)+0x46 (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x50556)
    #29 0x7ff80ec5e252 in _pthread_start+0x62 (libsystem_pthread.dylib:x86_64+0x6252)
    #30 0x7ff80ec59bee in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x1bee)

==97205==Register values:
rax = 0x0000000083828180  rbx = 0x0000102c01841800  rcx = 0x00007ffb121895ae  rdx = 0x00007ffb12189c7c
rdi = 0x0000000000000006  rsi = 0x000061d000491040  rbp = 0x0000700007431800  rsp = 0x0000700007431690
 r8 = 0x0000630000520400   r9 = 0x00006100006d29f0  r10 = 0x0000000000000001  r11 = 0x0000000000000005
r12 = 0x0000000000000004  r13 = 0x0000000000000000  r14 = 0x0000000000000001  r15 = 0x0000000000000000
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (GLEngine:x86_64+0x11f5ae) in gleRunVertexSubmitImmediate+0x20be
Thread T53 created by T0 here:
    #0 0x0001071652ed in pthread_create+0x5d (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x4b2ed)
    #1 0x00010a3a7662 in _PR_CreateThread+0x4a2 (libnss3.dylib:x86_64+0x486662)
    #2 0x00010a395f3e in PR_CreateThread+0xe (libnss3.dylib:x86_64+0x474f3e)
    #3 0x00013efab072 in nsThread::Init(nsTSubstring<char> const&)+0x242 (XUL:x86_64+0x1db4072)
    #4 0x00013efc00bf in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**)+0x34f (XUL:x86_64+0x1dc90bf)
    #5 0x00013efd4b8b in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions)+0x21b (XUL:x86_64+0x1dddb8b)
    #6 0x000142868c3d in nsresult NS_NewNamedThread<15ul>(char const (&) [15ul], nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions)+0x12d (XUL:x86_64+0x5671c3d)
    #7 0x000142867870 in mozilla::gfx::CanvasRenderThread::Start()+0x380 (XUL:x86_64+0x5670870)
    #8 0x00014265fcd6 in gfxPlatform::Init()+0x1116 (XUL:x86_64+0x5468cd6)
    #9 0x00014c6da5b7 in mozilla::widget::GfxInfoBase::GetContentBackend(nsTSubstring<char16_t>&)+0x1f7 (XUL:x86_64+0xf4e35b7)
    #10 0x00013f02f22d in NS_InvokeByIndex+0x8d (XUL:x86_64+0x1e3822d)
    #11 0x000140f2d313 in CallMethodHelper::Call()+0x6e3 (XUL:x86_64+0x3d36313)
    #12 0x000140f2ca38 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)+0x178 (XUL:x86_64+0x3d35a38)
    #13 0x000140f329a3 in XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*)+0x723 (XUL:x86_64+0x3d3b9a3)
    #14 0x00014f423cf5 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)+0x295 (XUL:x86_64+0x1222ccf5)
    #15 0x00014f422917 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)+0x857 (XUL:x86_64+0x1222b917)
    #16 0x00014f425b28 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)+0x1f8 (XUL:x86_64+0x1222eb28)
    #17 0x00014f429152 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)+0xe2 (XUL:x86_64+0x12232152)
    #18 0x00014fb177a7 in bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, js::PropertyInfoBase<unsigned int>, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType)+0x277 (XUL:x86_64+0x129207a7)
    #19 0x00014fb18d7a in bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType)+0x4ea (XUL:x86_64+0x12921d7a)
    #20 0x00014f471ff4 in js::GetObjectElementOperation(JSContext*, JSOp, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)+0x3b4 (XUL:x86_64+0x1227aff4)
    #21 0x00014f445b3d in js::Interpret(JSContext*, js::RunState&)+0x132dd (XUL:x86_64+0x1224eb3d)
    #22 0x00014f420a91 in js::RunScript(JSContext*, js::RunState&)+0x531 (XUL:x86_64+0x12229a91)
    #23 0x00014f422713 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)+0x653 (XUL:x86_64+0x1222b713)
    #24 0x00014f425b28 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)+0x1f8 (XUL:x86_64+0x1222eb28)
    #25 0x00014f429152 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)+0xe2 (XUL:x86_64+0x12232152)
    #26 0x00014fb177a7 in bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, js::PropertyInfoBase<unsigned int>, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType)+0x277 (XUL:x86_64+0x129207a7)
    #27 0x00014fb18d7a in bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType)+0x4ea (XUL:x86_64+0x12921d7a)
    #28 0x00014f51259e in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>)+0x11e (XUL:x86_64+0x1231b59e)
    #29 0x00014f47cb32 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>)+0x362 (XUL:x86_64+0x12285b32)
    #30 0x00014f440981 in js::Interpret(JSContext*, js::RunState&)+0xe121 (XUL:x86_64+0x12249981)
    #31 0x00014f420a91 in js::RunScript(JSContext*, js::RunState&)+0x531 (XUL:x86_64+0x12229a91)
    #32 0x00014f422713 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)+0x653 (XUL:x86_64+0x1222b713)
    #33 0x00014f425b28 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)+0x1f8 (XUL:x86_64+0x1222eb28)
    #34 0x00014f711b03 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)+0x533 (XUL:x86_64+0x1251ab03)
    #35 0x000140f19b7f in nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*)+0x133f (XUL:x86_64+0x3d22b7f)
    #36 0x00013f030ab0 in PrepareAndDispatch+0x2b0 (XUL:x86_64+0x1e39ab0)
    #37 0x00013f02f88a in SharedStub+0x5a (XUL:x86_64+0x1e3888a)
    #38 0x00013ef00068 in NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*)+0xc88 (XUL:x86_64+0x1d09068)
    #39 0x00014f16516d in nsXREDirProvider::DoStartup()+0x74d (XUL:x86_64+0x11f6e16d)
    #40 0x00014f13947e in XREMain::XRE_mainRun()+0x149e (XUL:x86_64+0x11f4247e)
    #41 0x00014f13d706 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)+0x1386 (XUL:x86_64+0x11f46706)
    #42 0x00014f13fad1 in XRE_main(int, char**, mozilla::BootstrapConfig const&)+0x181 (XUL:x86_64+0x11f48ad1)
    #43 0x000106ac3241 in main+0x841 (firefox:x86_64+0x100001241)
    #44 0x7ff80e8cf2cc in start+0x70c (dyld:x86_64+0xfffffffffff4f2cc)
  • Credit: GF, Bankai: Senbonzakura Kageyoshi
Flags: sec-bounty?

This bug may look same to bug 1937097, but it certainly seems to be a different vulnerability because the path that can actually trigger and the address where the crash occurs are different. (bug 1937097 case is crash on GLEngine:x86_64+0x11f8b2)

Group: firefox-core-security → gfx-core-security
Component: Security → Graphics: CanvasWebGL
Product: Firefox → Core
See Also: → CVE-2025-4082
See Also: → 1938194
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: needinfo?(jgilbert)
See Also: → 1937294
Status: NEW → RESOLVED
Closed: 1 year ago
Duplicate of bug: CVE-2025-4082
Flags: needinfo?(jgilbert)
Resolution: --- → DUPLICATE
Flags: sec-bounty? → sec-bounty-
See Also: CVE-2025-4082 →
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: