1944126 - (CVE-2025-1931) heap-use-after-free in WebTransportChild::RecvRemoteClosed

Reporter

Description

•

1 year ago

Attached file asan.log — Details

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0
Firefox for Android

Steps to reproduce:

class WebTransportChild : public PWebTransportChild { public: NS_INLINE_DECL_REFCOUNTING(WebTransportChild) explicit WebTransportChild(WebTransport* aTransport) : mTransport(aTransport) {} ... protected: WebTransport* mTransport; // WebTransport holds a strong reference to us, and // calls Shutdown() before releasing it virtual ~WebTransportChild() { MOZ_ASSERT(!mTransport); } }; [0]

void WebTransport::Cleanup(WebTransportError* aError, const WebTransportCloseInfo* aCloseInfo, ErrorResult& aRv) { ... // Step 12: if (aCloseInfo) { // 12.1: Resolve closed with closeInfo. LOG(("Resolving mClosed with closeinfo")); mClosed->MaybeResolve(*aCloseInfo); [1] // 12.2: Assert: ready is settled. MOZ_ASSERT(mReady->State() != Promise::PromiseState::Pending); // 12.3: Close incomingBidirectionalStreams // This keeps the clang-plugin happy RefPtr<ReadableStream> stream = mIncomingBidirectionalStreams; stream->CloseNative(cx, IgnoreErrors()); // 12.4: Close incomingUnidirectionalStreams stream = mIncomingUnidirectionalStreams; stream->CloseNative(cx, IgnoreErrors());

The WebTransport Renderer IPC channel objectmanages the WebTransport Owner object as a raw pointer. [0]

The vulnerability occurs because the Cleanup function is called in the RecvRemoteClosed function, and a user event is called in that function. [1]

https://searchfox.org/mozilla-central/source/dom/webtransport/child/WebTransportChild.h#51 [0]
https://searchfox.org/mozilla-central/source/dom/webtransport/child/WebTransportChild.cpp#34 [1]

The http3 server was created using the open source https://github.com/aiortc/aioquic/tree/main and the demo.py wt function code was edited.

An easy patch that I thought of would be to either pass a WebTransport object to the stack in RecvRemoteClosed as a RefPtr, or check by handling WeakPtr since there is no part of the code that references the WebTransport object later.

sherkito

Reporter

Comment 1

•

1 year ago

Attached file poc.html — Details

sherkito

Reporter

Comment 2

•

1 year ago

Attached file aioquic-main.zip — Details

sherkito

Reporter

Comment 3

•

1 year ago

(In reply to sherkito from comment #0)

Created attachment 9462034 [details]
asan.log

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0
Firefox for Android

Steps to reproduce:

 public:
  NS_INLINE_DECL_REFCOUNTING(WebTransportChild)
  explicit WebTransportChild(WebTransport* aTransport)
      : mTransport(aTransport) {}
 ...
 protected:
  WebTransport* mTransport;  // WebTransport holds a strong reference to us, and
                             // calls Shutdown() before releasing it
  virtual ~WebTransportChild() { MOZ_ASSERT(!mTransport); }
}; [0]```

```void WebTransport::Cleanup(WebTransportError* aError,
                           const WebTransportCloseInfo* aCloseInfo,
                           ErrorResult& aRv) {
   ...
  // Step 12:
  if (aCloseInfo) {
    // 12.1: Resolve closed with closeInfo.
    LOG(("Resolving mClosed with closeinfo"));
    mClosed->MaybeResolve(*aCloseInfo); [1]
    // 12.2: Assert: ready is settled.
    MOZ_ASSERT(mReady->State() != Promise::PromiseState::Pending);
    // 12.3: Close incomingBidirectionalStreams
    // This keeps the clang-plugin happy
    RefPtr<ReadableStream> stream = mIncomingBidirectionalStreams;
    stream->CloseNative(cx, IgnoreErrors());
    // 12.4: Close incomingUnidirectionalStreams
    stream = mIncomingUnidirectionalStreams;
    stream->CloseNative(cx, IgnoreErrors());```

The WebTransport Renderer IPC channel objectmanages the WebTransport Owner object as a raw pointer. [0] 

 The vulnerability occurs because the Cleanup function is called in the RecvRemoteClosed function, and a user event is called in that function. [1]

`https://searchfox.org/mozilla-central/source/dom/webtransport/child/WebTransportChild.h#51 [0]`
`https://searchfox.org/mozilla-central/source/dom/webtransport/child/WebTransportChild.cpp#34 [1]`

The http3 server was created using the open source `https://github.com/aiortc/aioquic/tree/main` and the demo.py `wt` function code was edited.

An easy patch that I thought of would be to either pass a WebTransport object to the stack in RecvRemoteClosed as a RefPtr, or check by handling WeakPtr since there is no part of the code that references the WebTransport object later.

asan.log 1 year ago sherkito 12.91 KB, text/x-log		Details
poc.html 1 year ago sherkito 733 bytes, text/html		Details
aioquic-main.zip 1 year ago sherkito 216.21 KB, application/x-zip-compressed		Details
Bug 1944126: Update WebTransportChild r=#dom-storage-reviewers! 1 year ago Randell Jesup [:jesup] (needinfo me) 48 bytes, text/x-phabricator-request	dmeehan : approval-mozilla-beta+ dmeehan : approval-mozilla-esr115+ dmeehan : approval-mozilla-esr128+ tjr : sec-approval+	Details \| Review
advisory.txt 11 months ago Daniel Veditz [:dveditz] 193 bytes, text/plain		Details

heap-use-after-free in WebTransportChild::RecvRemoteClosed

Security Approval Request

Beta/Release Uplift Approval Request