2038679 - (CVE-2026-8401) Make the BackupUI and MigrationWizard use remoteTypes

Status: RESOLVED FIXED

(Firefox :: Profile Backup, defect)

Description

[Andrew McCreight [:mccr8]]

This issue was originally reported by gaddofpwn in bug 2038573. There are a number of interesting issues we may want to fix in that report, so I am splitting off my patch for one issue here. I have marked this as sec-bounty? on their behalf here to ensure we track it.

The basic issue here is that the BackupUI actor can't use remoteTypes because it runs in both the parent process and the privilegedAbout process. Instead, it uses some checks in receiveMessage, but these can be bypassed. BackupUI is very powerful, so if a compromised content process can access it, it can be leveraged into a sandbox escape.

The fix here is to hack up a way to specify a remoteTypes that matches the parent in JSActorProtocol::RemoteTypePrefixMatches and then use that for BackupUI and MigrationUtils (which has the same kind of check).

Comment 1

[Andrew McCreight [:mccr8]]

BackupUI is not present on ESR115, but MigrationWizard. I'm not sure if it is as dangerous.

Comment 2

[Andrew McCreight [:mccr8]]

I've locally run the tests in browser/components/backup/tests/ and browser/components/migration/tests/ and they seem okay. The main risk here is that we run it in a regular content process somehow and we don't test that.

Comment 3

[Andrew McCreight [:mccr8]]

Attachment: (secure)

Comment 4

[Andrew McCreight [:mccr8]]

Comment on attachment 9585150 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: The basic issue is rather obvious from the patch, but based on bug 2038573 it does take some cleverness to exploit it, plus you need content process arbitrary code execution to even get at it.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: all, yes
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: No
• If not, how different, hard to create, and risky will they be?: Should be trivial. ESR115 will have to drop the BackUI part.
• How likely is this patch to cause regressions; how much testing does it need?: The risk is that these two actors actually do run in a regular content process in some cases, in which case that specific functionality will be broken.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: No

Comment 5

[Andrew McCreight [:mccr8]]

I think these actors are desktop-only but I could be wrong.

Comment 6

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: sec-high
• Code covered by automated testing?: yes
• Fix verified in Nightly?: no
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Might break the backupUI or MigrationWizard functionality if it is used in a different process than we do on testing.
• String changes made/needed?: none
• Is Android affected?: no

Comment 7

[Andrew McCreight [:mccr8]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D299722

Comment 8

[Phabricator Automation]

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: sec-high
• Code covered by automated testing?: yes
• Fix verified in Nightly?: no
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Might break the backupUI or MigrationWizard functionality if it is used in a different process than we do on testing.
• String changes made/needed?: none
• Is Android affected?: no

Comment 9

[Andrew McCreight [:mccr8]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D299722

Comment 10

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined/Reason for urgency: sec-high
• Code covered by automated testing?: yes
• Fix verified in Nightly?: no
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Might break the backupUI or MigrationWizard functionality if it is used in a different process than we do on testing.
• String changes made/needed?: none
• Is Android affected?: no

Comment 11

[Andrew McCreight [:mccr8]]

Attachment: (secure)

This folds in the first patch from bug 2005849 which only shuffles code around.

Original Revision: https://phabricator.services.mozilla.com/D299722

Comment 12

[Andrew McCreight [:mccr8]]

Attachment: (secure)

This folds in the first patch from bug 2005849 which only shuffles code around.

The BackupUI actor is not present in ESR115, so this only needs to fix
MigrationWizard.

Original Revision: https://phabricator.services.mozilla.com/D299722

Comment 13

[Phabricator Automation]

firefox-esr115 Uplift Approval Request

• User impact if declined/Reason for urgency: sec-high
• Code covered by automated testing?: yes
• Fix verified in Nightly?: no
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Might break the backupUI or MigrationWizard functionality if it is used in a different process than we do on testing.
• String changes made/needed?: none
• Is Android affected?: no

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/0285defa00b4
https://hg.mozilla.org/integration/autoland/rev/ef49b255ce2a
Add remoteTypes for BackupUI and MigrationWizard. r=mconley,nika

Comment 15

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/eb22f76af9be
https://hg.mozilla.org/releases/mozilla-release/rev/7bf74f2f82ed

Comment 16

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/f33684914df3
https://hg.mozilla.org/releases/mozilla-beta/rev/13197dea318e

Comment 17

[Andrew McCreight [:mccr8]]

I got an email from Lando saying "Lando: Landing of D299722 failed!" about half an hour ago, but as far as I can see it has landed on autoland successfully so I'm going to ignore that.

Comment 18

[Donal Meehan [:dmeehan]]

(In reply to Andrew McCreight [:mccr8] from comment #17)

I got an email from Lando saying "Lando: Landing of D299722 failed!" about half an hour ago, but as far as I can see it has landed on autoland successfully so I'm going to ignore that.

That's safe to ignore, it was pushed directly since autoland was closed

Comment 19

[Dianna Smith [:diannaS]]

Yes, you can ignore it. The sheriffs manually landed it because autoland was closed... making the automatic request fail. I tried to cancel the request but that failed as well.

oops didnt see Donal's message. What he said!

Comment 20

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ef49b255ce2a

Comment 21

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/282b24f40324

Comment 22

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/7f45511d24d0

Comment 23

[Simon Friedberger [:simonf]]

Attachment: advisory.txt

Updated advisory.txt

Comment 25

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/d61566d7423d

Comment 26

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/d69e76bf84e2

Comment 27

[Daniel Veditz [:dveditz]]

This was the main "sandbox escape" fix and CVE for the pwn2own exploit, but we're going to move the bounty request to the reporter's own bug for clarity