1979502 - (CVE-2025-10532) Assertion failure: !empty(), at dist/include/mozilla/Vector.h:597

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P3)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

for (let i = 0; i < 200; i++) {
  var x = /x/;
  oomTest(function () {
    gcslice(99999);
    enableGeckoProfiling();
    disableGeckoProfiling();
  });
}

(gdb) bt
#0  0x0000555557deec44 in MOZ_CrashSequence (aAddress=0x0, aLine=597) at /home/msf1/shell-cache/js-dbg-64-linux-x86_64-37783a3d0d3f/objdir-js/dist/include/mozilla/Assertions.h:248
#1  mozilla::Vector<js::gcstats::Statistics::SliceData, 8ul, js::SystemAllocPolicy>::back (this=0x7ffff5e329c0)
    at /home/msf1/shell-cache/js-dbg-64-linux-x86_64-37783a3d0d3f/objdir-js/dist/include/mozilla/Vector.h:597
#2  js::gcstats::Statistics::recordParallelPhase (this=0x7ffff5e32960, phaseKind=js::gcstats::PhaseKind::SWEEP, duration=...)
    at /home/msf1/trees/mozilla-central/js/src/gc/Statistics.cpp:1569
#3  0x0000555557d2ed27 in js::GCParallelTask::join (this=0x7ffff5e349b0, deadline=...) at /home/msf1/trees/mozilla-central/js/src/gc/GCParallelTask.cpp:95
#4  0x0000555557df1820 in js::gc::GCRuntime::waitBackgroundSweepEnd (this=0x7ffff5e32888) at /home/msf1/trees/mozilla-central/js/src/gc/Sweeping.cpp:547
#5  0x000055555740ed49 in js::gc::ZoneAllCellIter<js::gc::TenuredCell>::initForTenuredIteration (this=0x7fffffffb210, zone=0x7ffff4cc9000, kind=<optimized out>)
    at /home/msf1/trees/mozilla-central/js/src/gc/GC-inl.h:159
/snip

This seems to have occurred since prior to m-c rev 1db2ef126a6a, gh rev 48de8371eacd8be6e794cba9b8849d085edaecf1 (late-Apr 2024, Firefox 127-approx).

Run with --fuzzing-safe --ion-offthread-compile=off --ion-eager, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 37783a3d0d3f.

This seems to be really reproducible on a machine for me, yet unreliable/non-reproducible on another, I'm not sure why.

Jon/Steve, any ideas?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: x00

Combine using:

cat x00 x01 > out.tar.xz

The SHA-256 checksum of the tarball should be 6da9f9b8f4bade01899579150e9957cade3868fa2dc408d07a204f40eca4472e, and this will contain the coredump.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: x01

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: xaa

Combine using:

cat xa* > binary.tar.xz

The SHA-256 checksum of the tarball should be 0276315941f33d76f4acae594ebf8d8cc58bb3c2c7cad7707b48a92d474515f7, and this will contain the shell.

Run these with gdb using gdb SHELL COREDUMP. I split this up due to Bugzilla attachment upload size limitations.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: xab

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: xac

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: xad

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: xae

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: xaf

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: xag

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: xah

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: xai

Comment 12

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Use the set substitute-path command in gdb to change paths to the local m-c source directory.

Comment 13

[Jon Coppeard (:jonco)]

I can't reproduce this but I can see what the problem is.

Comment 14

[Jon Coppeard (:jonco)]

Attachment: (secure)

|aborted| is reset to false at the end of a slice but
GCRuntime::waitBackgroundSweepEnd can be called outside of a slice.

Comment 15

[Jon Coppeard (:jonco)]

This is a buffer overrun but it depends on OOM happening at a particular point and is also depends on a later operation happening at the right time. So this is hard to trigger.

Comment 16

[Jon Coppeard (:jonco)]

I'll mark this sec-moderate as it requires OOM and difficult timing to trigger.

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/f9bc61fed779
https://hg.mozilla.org/integration/autoland/rev/68d37f9acbd4
Check slices vector not empty before accessing the last slice r=sfink

Comment 18

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1634429

Comment 19

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/68d37f9acbd4

Comment 20

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:jonco, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox142 to wontfix.

For more information, please visit BugBot documentation.

Comment 21

[Ryan VanderMeulen [:RyanVM]]

We'll want an ESR140 uplift request, but that'll be all at this point.

Comment 22

[Jon Coppeard (:jonco)]

Comment on attachment 9506407 [details]
(secure)

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is still a possible security vulnerability it's just harder to exploit because it requires OOM.
• User impact if declined: Possible crash / security vulnerability.
• Fix Landed on Version: 143
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a very simple change and has been present in nightly for two weeks without incident.

Comment 23

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9506407 [details]
(secure)

Approved for 140.3esr.

Comment 24

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/43b4033ea3e9