Closed Bug 2034791 Opened 5 months ago Closed 5 months ago

VisitedModuleSet is not updated correctly on moving GC

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
152 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox-esr140 --- unaffected
firefox150 --- wontfix
firefox151 + fixed
firefox152 + fixed

People

(Reporter: jonco, Assigned: jonco)

References

(Regression)

Details

(Keywords: csectype-uaf, regression, sec-moderate, Whiteboard: [adv-main151+r])

Attachments

(2 files)

(secure)
48 bytes, text/x-phabricator-request
Details | Review
(secure)
48 bytes, text/x-phabricator-request
phab-bot
: approval-mozilla-beta+
Details | Review

This uses DefaultHasher (pointer hashing) which means the table can break on moving GC. If this happens iterating the table should work (because it is traced and keys updated) but lookups may fail (because entries won't be moved to their correct position).

This means that the visited check here could give the wrong result: https://searchfox.org/firefox-main/source/js/src/vm/Modules.cpp#1524

Even knowing what the problem is I have been unable to come up with a test case that fails (and nor has Claude).

Keywords: csectype-uaf, regression
Regressed by: 1820594
Attached file (secure) —

Set release status flags based on info from the regressing bug 1820594

status-firefox150: --- → affected
status-firefox151: --- → affected
status-firefox152: --- → affected
status-firefox-esr140: --- → unaffected
Pushed by jcoppeard@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/d7159275dd2a https://hg.mozilla.org/integration/autoland/rev/405ce57a75cd Make VisitedModuleSet use stable cell hashing r=spidermonkey-reviewers,iain

https://hg.mozilla.org/mozilla-central/rev/405ce57a75cd

Group: javascript-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 5 months ago
status-firefox152: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 152 Branch

Please add a beta uplift request

status-firefox150: affected → wontfix
status-firefox-esr115: --- → unaffected
tracking-firefox151: --- → +
tracking-firefox152: --- → +

firefox-beta Uplift Approval Request

  • User impact if declined/Reason for urgency: Possible crash / security vulnerability.
  • Code covered by automated testing?: yes
  • Fix verified in Nightly?: yes
  • Needs manual QE testing?: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: This is a simple change to use stable hashing for a hash table. It's been on central for two days with no issues.
  • String changes made/needed?: None
  • Is Android affected?: yes
Attachment #9574012 - Flags: approval-mozilla-beta?
Attached file (secure) —

Original Revision: https://phabricator.services.mozilla.com/D296332

Attachment #9574012 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
QA Whiteboard: [sec] [qa-triage-done-c152/b151]
Whiteboard: [adv-main151+r][adv-esr115.36+r][adv-esr140.11+r]
Whiteboard: [adv-main151+r][adv-esr115.36+r][adv-esr140.11+r] → [adv-main151+r]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: