643450 - Problem with nsJSContext::CallEventHandler

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

In nsJSContext::CallEventHandler, after popping a principal, when converting
rval to variant, we access properties of rval if rval is an array.  Thus, it's
possible to call a native function without a frame or a pushed principal, in
which case a result of nsScriptSecurityManager::IsCapabilityEnabled() is true.

Comment 1

[moz_bug_r_a4]

Attachment: testcase - arbitrary code execution

Comment 2

[Boris Zbarsky [:bzbarsky]]

Probably needs .x+ blocking.

I can't seem to get the problem to happen with 3.6.  Is this trunk-only?

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

The Pop is there even in 1.9.0.x

Comment 4

[moz_bug_r_a4]

(In reply to comment #2)
> I can't seem to get the problem to happen with 3.6.  Is this trunk-only?

On 1.9.2/1.9.1, only fast native functions can be called without a frame.  I
think that if there is a fast native function that can be used for doing evil
things, 1.9.2/1.9.1 could be affected.

Comment 5

[moz_bug_r_a4]

Basically, this bug's intention is to circumvent the fix for bug 614151 (though
I can't see that bug).  Is bug 614151 trunk-only?

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Ah, that looks like trunk only.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

I CC'd you to bug 614151.

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

I'm not adding a testcase for this bug since it uses the Array.prototype.shift trick.

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/a91752ea97cf

Comment 10

[Cameron Kaiser [:spectre]]

Per security group discussion, requesting landing on mozilla-2.0.

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: 1.9.2 patch

Comment 12

[Daniel Veditz [:dveditz]]

Comment on attachment 537630 [details] [diff] [review]
1.9.2 patch

Approved for 1.9.2.18, a=dveditz for release-drivers

Comment 13

[Daniel Veditz [:dveditz]]

Comment on attachment 537630 [details] [diff] [review]
1.9.2 patch

Guess this didn't make 3.6.18 -- next time.

Comment 14

[Daniel Veditz [:dveditz]]

Comment on attachment 523429 [details] [diff] [review]
Proposed fix

Approved for the mozilla2.0 repository, a=dveditz for release-drivers

Comment 15

[Al Billings [:abillings - ex-MoCo]]

Blake, can you land this on 1.9.2, please?

Comment 16

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/9dcf7969ddac

Comment 17

[Al Billings [:abillings - ex-MoCo]]

(In reply to moz_bug_r_a4 from comment #1)
> Created attachment 520663 [details]
> testcase - arbitrary code execution

On 1.9.2.18 on XP, loading this testcase over the net or locally does not cause any issues (or any real behavior at all). We just get a blank iframe.

Was the bad behavior ever actually seen on 1.9.2?

Comment 18

[Al Billings [:abillings - ex-MoCo]]

https://bugzilla.mozilla.org/show_bug.cgi?id=650252#c6 references this bug. Are the exploits related as that one is definitely fixed and can be verified.

Comment 19

[moz_bug_r_a4]

(In reply to Al Billings [:abillings] from comment #17)
> Was the bad behavior ever actually seen on 1.9.2?

No, the testcase did not work on 1.9.2.