Closed Bug 2013584 (CVE-2026-2804) Opened 9 months ago Closed 9 months ago

AddressSanitizer: heap-use-after-free [@ js::wasm::GetImports] with READ of size 4

Categories

(Core :: JavaScript: WebAssembly, defect, P1)

Product:
Core
Component:
JavaScript: WebAssembly
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
149 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- wontfix
firefox-esr140 --- wontfix
firefox147 --- wontfix
firefox148 + fixed
firefox149 + fixed

People

(Reporter: decoder, Assigned: jpages)

References

Details

(7 keywords, Whiteboard: [bugmon:update,bisected,confirmed][adv-main148+])

Attachments

(3 files, 2 external files)

Detailed Crash Information
16.37 KB, text/plain
Details
Testcase
3.77 KB, text/javascript
Details
advisory.txt
147 bytes, text/plain
Details

The following testcase crashes on mozilla-central revision 20260130-20b1a1e6c530 (fuzzing-asan-opt build, run with --fuzzing-safe --no-threads):

See attachment.

Backtrace:

=================================================================
==1738683==ERROR: AddressSanitizer: heap-use-after-free on address 0x777ec9fe9e30 at pc 0x5b641e5fa010 bp 0x7ffd7ac90f50 sp 0x7ffd7ac90f48
READ of size 4 at 0x777ec9fe9e30 thread T0
    #0 0x5b641e5fa00f in js::wasm::GetImports(JSContext*, js::wasm::Module const&, JS::Handle<JSObject*>, js::wasm::ImportValues*) /js/src/wasm/WasmJS.cpp:245:20
    #1 0x5b641e60d840 in js::WasmInstanceObject::construct(JSContext*, unsigned int, JS::Value*) /js/src/wasm/WasmJS.cpp:1987:8
    #2 0x5b641dd69368 in CallJSNative /js/src/vm/Interpreter.cpp:490:13
    #3 0x5b641dd69368 in CallJSNativeConstructor /js/src/vm/Interpreter.cpp:508:8
    #4 0x5b641dd69368 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:714:14
    #5 0x5b641dd84bf4 in ConstructFromStack /js/src/vm/Interpreter.cpp:761:10
    #6 0x5b641dd84bf4 in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3257:16
    #7 0x5b641dd65986 in MaybeEnterInterpreterTrampoline /js/src/vm/Interpreter.cpp:384:10
    #8 0x5b641dd65986 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:460:13
    #9 0x5b641dd6ab4c in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:850:10
    #10 0x5b641e11bba1 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /js/src/vm/CompilationAndEvaluation.cpp:572:10
    #11 0x5b641c0ffa55 in RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool, bool) /js/src/shell/js.cpp:1387:10
    #12 0x5b641c0fee31 in Process(JSContext*, char const*, bool, FileKind) /js/src/shell/js.cpp
    #13 0x5b641c07934a in ProcessArgs /js/src/shell/js.cpp:12110:10
    #14 0x5b641c07934a in Shell(JSContext*, js::cli::OptionParser*) /js/src/shell/js.cpp:12363:12
    #15 0x5b641c061ee7 in main /js/src/shell/js.cpp:12769:12
    #16 0x7b1ecac2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #17 0x7b1ecac2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #18 0x5b641bf691f8 in _start (/home/decoder/Mozilla/Anthropic/.builds/asan/js/dist/bin/js+0x2d201f8) (BuildId: b9b60630d05b45547bce8211e76c23e091144ce3)

0x777ec9fe9e30 is located 48 bytes inside of 56-byte region [0x777ec9fe9e00,0x777ec9fe9e38)
freed by thread T0 here:
    #0 0x5b641c00a2f6 in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3
    #1 0x5b641e469bf1 in js_free /builds/worker/workspace/obj-build/dist/include/js/Utility.h:434:3
    #2 0x5b641e469bf1 in free_<js::wasm::Import> /builds/worker/workspace/obj-build/dist/include/js/AllocPolicy.h:88:5
    #3 0x5b641e469bf1 in ~Vector /builds/worker/workspace/obj-build/dist/include/mozilla/Vector.h:1010:11
    #4 0x5b641e469bf1 in js::wasm::ModuleMetadata::~ModuleMetadata() /js/src/wasm/WasmMetadata.h:422:8
    #5 0x5b641e7585c9 in js_delete<js::wasm::ModuleMetadata> /builds/worker/workspace/obj-build/dist/include/js/Utility.h:580:9
    #6 0x5b641e7585c9 in Release /builds/worker/workspace/obj-build/dist/include/js/RefCounted.h:77:7
    #7 0x5b641e7585c9 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:49:40
    #8 0x5b641e7585c9 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:417:7
    #9 0x5b641e7585c9 in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:80:7
    #10 0x5b641e7585c9 in js::wasm::Module::~Module() /js/src/wasm/WasmModule.cpp:159:1
    #11 0x5b641e5fd062 in js_delete<JS::WasmModule> /builds/worker/workspace/obj-build/dist/include/js/Utility.h:580:9
    #12 0x5b641e5fd062 in Release /builds/worker/workspace/obj-build/dist/include/js/RefCounted.h:77:7
    #13 0x5b641e5fd062 in release<const js::wasm::Module> /js/src/gc/GCContext-inl.h:27:8
    #14 0x5b641e5fd062 in js::WasmModuleObject::finalize(JS::GCContext*, JSObject*) /js/src/wasm/WasmJS.cpp:1144:8
    #15 0x5b641cd28d51 in doFinalize /builds/worker/workspace/obj-build/dist/include/js/Class.h:663:5
    #16 0x5b641cd28d51 in finalize /js/src/vm/JSObject-inl.h:90:10
    #17 0x5b641cd28d51 in unsigned long js::gc::Arena::finalize<JSObject, (js::gc::FinalizeKind)2>(JS::GCContext*, js::gc::AllocKind, unsigned long) /js/src/gc/Sweeping.cpp:162:12
    #18 0x5b641cd31a0a in bool FinalizeTypedArenas<JSObject, (js::gc::FinalizeKind)1, (js::gc::ReleaseEmpty)0>(JS::GCContext*, js::gc::ArenaList&, js::gc::SortedArenaList&, js::gc::AllocKind, JS::SliceBudget&) /js/src/gc/Sweeping.cpp:220:16
    #19 0x5b641cce4454 in js::gc::ArenaLists::foregroundFinalize(JS::GCContext*, js::gc::AllocKind, JS::SliceBudget&, js::gc::SortedArenaList&) /js/src/gc/Sweeping.cpp:1923:8
    #20 0x5b641cceab78 in js::gc::GCRuntime::finalizeAllocKind(JS::GCContext*, JS::SliceBudget&) /js/src/gc/Sweeping.cpp:2138:19
    #21 0x5b641cd1bc96 in sweepaction::SweepActionForEach<ContainerIter<mozilla::EnumSet<js::gc::AllocKind, unsigned long>>, mozilla::EnumSet<js::gc::AllocKind, unsigned long>>::run(js::gc::SweepAction::Args&) /js/src/gc/Sweeping.cpp:2383:19
    #22 0x5b641cd32e37 in sweepaction::SweepActionSequence::run(js::gc::SweepAction::Args&) /js/src/gc/Sweeping.cpp:2348:23
    #23 0x5b641cd1b6e7 in sweepaction::SweepActionForEach<js::gc::SweepGroupZonesIter, JSRuntime*>::run(js::gc::SweepAction::Args&) /js/src/gc/Sweeping.cpp:2383:19
    #24 0x5b641cd32e37 in sweepaction::SweepActionSequence::run(js::gc::SweepAction::Args&) /js/src/gc/Sweeping.cpp:2348:23
    #25 0x5b641cd1af97 in sweepaction::SweepActionForEach<js::gc::SweepGroupsIter, JSRuntime*>::run(js::gc::SweepAction::Args&) /js/src/gc/Sweeping.cpp:2383:19
    #26 0x5b641cceed6e in js::gc::GCRuntime::performSweepActions(JS::SliceBudget&) /js/src/gc/Sweeping.cpp:2567:53
    #27 0x5b641cc2bf93 in js::gc::GCRuntime::incrementalSlice(JS::SliceBudget&, JS::GCReason, bool) /js/src/gc/GC.cpp:4081:11
    #28 0x5b641cc310a5 in js::gc::GCRuntime::gcCycle(bool, JS::SliceBudget const&, JS::GCReason) /js/src/gc/GC.cpp:4634:3
    #29 0x5b641cc32b3d in js::gc::GCRuntime::collect(bool, JS::SliceBudget const&, JS::GCReason) /js/src/gc/GC.cpp:4823:9
    #30 0x5b641cc3b51e in gc /js/src/gc/GC.cpp:4903:3
    #31 0x5b641cc3b51e in JS::NonIncrementalGC(JSContext*, JS::GCOptions, JS::GCReason) /js/src/gc/GCAPI.cpp:300:21
    #32 0x5b641c4f9a50 in GC(JSContext*, unsigned int, JS::Value*) /js/src/builtin/TestingFunctions.cpp:789:3
    #33 0x5b641dd66b6d in CallJSNative /js/src/vm/Interpreter.cpp:490:13
    #34 0x5b641dd66b6d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:586:12
    #35 0x5b641dd84c7c in InternalCall /js/src/vm/Interpreter.cpp:653:10
    #36 0x5b641dd84c7c in CallFromStack /js/src/vm/Interpreter.cpp:658:10
    #37 0x5b641dd84c7c in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3272:16
    #38 0x5b641dd65986 in MaybeEnterInterpreterTrampoline /js/src/vm/Interpreter.cpp:384:10
    #39 0x5b641dd65986 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:460:13
    #40 0x5b641dd66ce7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
    #41 0x5b641dd687f4 in InternalCall /js/src/vm/Interpreter.cpp:653:10
    #42 0x5b641dd687f4 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
    #43 0x5b641dd3499c in js::ScriptedProxyHandler::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) const /js/src/proxy/ScriptedProxyHandler.cpp:1151:10
    #44 0x5b641dd22de2 in getInternal /js/src/proxy/Proxy.cpp:524:19
    #45 0x5b641dd22de2 in js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /js/src/proxy/Proxy.cpp:532:10
    #46 0x5b641e5f78fa in GetProperty /js/src/vm/ObjectOperations-inl.h:110:12
    #47 0x5b641e5f78fa in GetProperty /js/src/vm/ObjectOperations-inl.h:127:10
    #48 0x5b641e5f78fa in js::wasm::GetImports(JSContext*, js::wasm::Module const&, JS::Handle<JSObject*>, js::wasm::ImportValues*) /js/src/wasm/WasmJS.cpp:239:12
    #49 0x5b641e60d840 in js::WasmInstanceObject::construct(JSContext*, unsigned int, JS::Value*) /js/src/wasm/WasmJS.cpp:1987:8
    #50 0x5b641dd69368 in CallJSNative /js/src/vm/Interpreter.cpp:490:13
    #51 0x5b641dd69368 in CallJSNativeConstructor /js/src/vm/Interpreter.cpp:508:8
    #52 0x5b641dd69368 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:714:14
    #53 0x5b641dd84bf4 in ConstructFromStack /js/src/vm/Interpreter.cpp:761:10
    #54 0x5b641dd84bf4 in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3257:16

previously allocated by thread T0 here:
    #0 0x5b641c00a594 in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3
    #1 0x5b641e543209 in js_arena_malloc /builds/worker/workspace/obj-build/dist/include/js/Utility.h:386:10
    #2 0x5b641e543209 in js_pod_arena_malloc<js::wasm::Import> /builds/worker/workspace/obj-build/dist/include/js/Utility.h:601:26
    #3 0x5b641e543209 in maybe_pod_arena_malloc<js::wasm::Import> /builds/worker/workspace/obj-build/dist/include/js/AllocPolicy.h:32:12
    #4 0x5b641e543209 in pod_arena_malloc<js::wasm::Import> /builds/worker/workspace/obj-build/dist/include/js/AllocPolicy.h:45:12
    #5 0x5b641e543209 in pod_malloc<js::wasm::Import> /builds/worker/workspace/obj-build/dist/include/js/AllocPolicy.h:75:12
    #6 0x5b641e543209 in mozilla::Vector<js::wasm::Import, 0ul, js::SystemAllocPolicy>::convertToHeapStorage(unsigned long) /builds/worker/workspace/obj-build/dist/include/mozilla/Vector.h:1036:30
    #7 0x5b641e757d3c in growByUninitialized /builds/worker/workspace/obj-build/dist/include/mozilla/Vector.h:1182:9
    #8 0x5b641e757d3c in bool mozilla::Vector<js::wasm::Import, 0ul, js::SystemAllocPolicy>::emplaceBack<js::wasm::CacheableName, js::wasm::CacheableName, js::wasm::DefinitionKind>(js::wasm::CacheableName&&, js::wasm::CacheableName&&, js::wasm::DefinitionKind&&) /builds/worker/workspace/obj-build/dist/include/mozilla/Vector.h:776:10
    #9 0x5b641e834997 in DecodeImportGroup /js/src/wasm/WasmValidate.cpp:3247:30
    #10 0x5b641e834997 in DecodeImportSection /js/src/wasm/WasmValidate.cpp:3349:10
    #11 0x5b641e834997 in js::wasm::DecodeModuleEnvironment(js::wasm::Decoder&, js::wasm::CodeMetadata*, js::wasm::ModuleMetadata*) /js/src/wasm/WasmValidate.cpp:4058:8
    #12 0x5b641e535ae4 in js::wasm::CompileBuffer(js::wasm::CompileArgs const&, js::wasm::BytecodeBufferOrSource const&, std::unique_ptr<char [], JS::FreePolicy>*, mozilla::Vector<std::unique_ptr<char [], JS::FreePolicy>, 0ul, js::SystemAllocPolicy>*, JS::OptimizedEncodingListener*) /js/src/wasm/WasmCompile.cpp:967:8
    #13 0x5b641e608525 in js::WasmModuleObject::construct(JSContext*, unsigned int, JS::Value*) /js/src/wasm/WasmJS.cpp:1687:14
    #14 0x5b641dd69368 in CallJSNative /js/src/vm/Interpreter.cpp:490:13
    #15 0x5b641dd69368 in CallJSNativeConstructor /js/src/vm/Interpreter.cpp:508:8
    #16 0x5b641dd69368 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:714:14
    #17 0x5b641dd84bf4 in ConstructFromStack /js/src/vm/Interpreter.cpp:761:10
    #18 0x5b641dd84bf4 in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3257:16
    #19 0x5b641dd65986 in MaybeEnterInterpreterTrampoline /js/src/vm/Interpreter.cpp:384:10
    #20 0x5b641dd65986 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:460:13
    #21 0x5b641dd6ab4c in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:850:10
    #22 0x5b641e11b397 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) /js/src/vm/CompilationAndEvaluation.cpp:565:10
    #23 0x5b641c0a4f70 in EvaluateInner(JSContext*, JS::Handle<JSString*>, JS::MutableHandle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) /js/src/shell/js.cpp:3170:32
    #24 0x5b641c0a6f89 in Evaluate(JSContext*, unsigned int, JS::Value*) /js/src/shell/js.cpp:2907:10
    #25 0x5b641dd66b6d in CallJSNative /js/src/vm/Interpreter.cpp:490:13
    #26 0x5b641dd66b6d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:586:12
    #27 0x5b641dd687f4 in InternalCall /js/src/vm/Interpreter.cpp:653:10
    #28 0x5b641dd687f4 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
    #29 0x5b641dd3d44f in js::ForwardingProxyHandler::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const /js/src/proxy/Wrapper.cpp:166:10
    #30 0x5b641dd1747b in js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const /js/src/proxy/CrossCompartmentWrapper.cpp:230:19
    #31 0x5b641dd263c1 in js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) /js/src/proxy/Proxy.cpp:703:19
    #32 0x5b641dd671b5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:566:14
    #33 0x5b641dd84c7c in InternalCall /js/src/vm/Interpreter.cpp:653:10
    #34 0x5b641dd84c7c in CallFromStack /js/src/vm/Interpreter.cpp:658:10
    #35 0x5b641dd84c7c in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3272:16
    #36 0x5b641dd65986 in MaybeEnterInterpreterTrampoline /js/src/vm/Interpreter.cpp:384:10
    #37 0x5b641dd65986 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:460:13
    #38 0x5b641dd6ab4c in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:850:10
    #39 0x5b641e11bba1 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /js/src/vm/CompilationAndEvaluation.cpp:572:10
    #40 0x5b641c0ffa55 in RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool, bool) /js/src/shell/js.cpp:1387:10
    #41 0x5b641c0fee31 in Process(JSContext*, char const*, bool, FileKind) /js/src/shell/js.cpp
    #42 0x5b641c07934a in ProcessArgs /js/src/shell/js.cpp:12110:10
    #43 0x5b641c07934a in Shell(JSContext*, js::cli::OptionParser*) /js/src/shell/js.cpp:12363:12
    #44 0x5b641c061ee7 in main /js/src/shell/js.cpp:12769:12
    #45 0x7b1ecac2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #46 0x7b1ecac2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #47 0x5b641bf691f8 in _start (/home/decoder/Mozilla/Anthropic/.builds/asan/js/dist/bin/js+0x2d201f8) (BuildId: b9b60630d05b45547bce8211e76c23e091144ce3)

SUMMARY: AddressSanitizer: heap-use-after-free /js/src/wasm/WasmJS.cpp:245:20 in js::wasm::GetImports(JSContext*, js::wasm::Module const&, JS::Handle<JSObject*>, js::wasm::ImportValues*)
Shadow bytes around the buggy address:
  0x777ec9fe9b80: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
  0x777ec9fe9c00: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x777ec9fe9c80: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
  0x777ec9fe9d00: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x777ec9fe9d80: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
=>0x777ec9fe9e00: fd fd fd fd fd fd[fd]fa fa fa fa fa fd fd fd fd
  0x777ec9fe9e80: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x777ec9fe9f00: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x777ec9fe9f80: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x777ec9fea000: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fa
  0x777ec9fea080: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1738683==ABORTING

This bug is part of a series of bugs reported by Anthropic, thank you for your contributions to Firefox!

Attached file Testcase —
Group: javascript-core-security

Use-after-free coming from WasmValidate.cpp, I can reproduce the issue in local. I'll do a quick investigation of this one.

Assignee: nobody → jpages

Verified bug as reproducible on mozilla-central 20260131091743-1be4ab5933df.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: d87cd04072b041911d218cec1baf59de7f2a5ede (20251103213617)
End: 20b1a1e6c530f3506d5378bf5f4da504b6f03661 (20260130092147)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Whiteboard: [bugmon:update,bisect] → [bugmon:update,bisected,confirmed]

The test case gets a CCW to a module g2 while in a global g1, then passes the CCW to new WebAssembly.Instance(), then does some fancy stuff to nuke the CCW at a certain point leaving a dangling pointer. In the browser, we only nuke CCWs from chrome to content. g1 would thus have to be running chrome JS while g2 is running content. If chrome JS is compiling WASM from content, there's probably worse things you can do than create a dangling pointer, so this seems sec-moderate at worst.

Keywords: csectype-uaf, sec-moderate
See Also: → 2013586

This issue is caused by a missing GC root during the creation of a wasm module.

The testcase is a bit long, but because if this missing gc root, the module gets collected by the garbage collector, leaving us with a dangling pointer.

Attached file (secure) —
Severity: -- → S3
status-firefox147: --- → affected
status-firefox148: --- → affected
status-firefox-esr140: --- → affected
Priority: -- → P1
Duplicate of this bug: 2013586

Any ideas why this wasn't found by the rooting analysis?

(In reply to Tom Schuster from comment #9)

Any ideas why this wasn't found by the rooting analysis?

The problem was with a WasmModuleObject (gc thing) which owns a wasm::Module (malloc thing). This bug was caused by us grabbing a pointer to just the inner wasm::Module, without ensuring we had rooted the owning WasmModuleObject. In the non-CCW case we would, but if there was a CCW we wouldn't.

I think we'd need to extend rooting analysis to be aware that the lifetime of the wasm::Module is tied to the WasmModuleObject. I'm not sure how hard that is to do.

https://hg-edge.mozilla.org/mozilla-central/rev/f2839ea6aa24

Group: javascript-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 9 months ago
status-firefox149: affected → fixed
tracking-firefox148: --- → +
tracking-firefox149: --- → +
tracking-firefox-esr140: --- → 148+
Resolution: --- → FIXED
Target Milestone: --- → 149 Branch

Verified bug as fixed on rev mozilla-central 20260205042023-4779d1a57487.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon

The patch landed in nightly and beta is affected.
:jpages, is this bug important enough to require an uplift?

For more information, please visit BugBot documentation.

Flags: needinfo?(jpages)

:jpages, to add to comment 14, this will need a rebased patch for ESR140 uplift

firefox-beta Uplift Approval Request

  • User impact if declined: Use-after-free vulnerability that can lead to exploits.
  • Code covered by automated testing: yes
  • Fix verified in Nightly: yes
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: Landed in nightly, this is a refactoring of the code to add missing GC roots, fixing some use-after-free problems.
  • String changes made/needed: None
  • Is Android affected?: yes
Attachment #9543178 - Flags: approval-mozilla-beta?
Attached file (secure) —

Original Revision: https://phabricator.services.mozilla.com/D281557

status-firefox-esr140: affected → wontfix
Flags: needinfo?(jpages)
Attachment #9543178 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Whiteboard: [bugmon:update,bisected,confirmed] → [bugmon:update,bisected,confirmed][adv-main148+]
Alias: CVE-2026-2804

What's the plan for 140esr and 115esr?
Are you wontfix-ing them definitely? and keeping this hidden until EOL?

Blocks: 2013586
No longer duplicate of this bug: 2013586

(In reply to Giorgio Maone [:ma1] from comment #20)

What's the plan for 140esr and 115esr?
Are you wontfix-ing them definitely? and keeping this hidden until EOL?

Per comment 5 and comment 10 this could only happen in the CCW case and the conditions couldn't be triggered from web content. Unless that's wrong we don't intend to backport this to ESR, and would not need to keep the bug hidden until EOL.

Group: core-security-release
Keywords: keep-hidden
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: