835038 - Compromised content process can create TCP sockets willy nilly

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[Josh Matthews [:jdm]]

We don't insist on a non-null PBrowser on which to perform permission checks. This is exceedingly bad.

Comment 1

[Josh Matthews [:jdm]]

Attachment: Ensure IPC TCP sockets always have permission checks applied.

Comment 2

[Lawrence Mandel [:lmandel] (use needinfo)]

tef- but please request approval when ready so this can be considered for uplift.

Comment 3

[Jason Duell]

Renom as tef+: this is a pretty bad security hole and the fix is trivial.

Comment 4

[Ben Turner (not reading bugmail, use the needinfo flag!)]

(In reply to Jason Duell (:jduell) from comment #3)
> Renom as tef+: this is a pretty bad security hole and the fix is trivial.

You probably just want to ask for approval to land, I think.

Comment 5

[Lawrence Mandel [:lmandel] (use needinfo)]

(In reply to Jason Duell (:jduell) from comment #3)
> Renom as tef+: this is a pretty bad security hole and the fix is trivial.

cc Lucas and Johnny 

The consensus in triage is that we do want to fix this but it is not a critical enough issue to block the release.

Comment 6

[Josh Matthews [:jdm]]

Comment on attachment 706776 [details] [diff] [review]
Ensure IPC TCP sockets always have permission checks applied.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 770778
User impact if declined: Compromised content could open up arbitrary TCP connections regardless of app permissions.
Testing completed: Manual testing.
Risk to taking this patch (and alternatives if risky): None.
String or UUID changes made by this patch: None

Comment 7

[Lukas Blakk [:lsblakk] use ?needinfo]

Comment on attachment 706776 [details] [diff] [review]
Ensure IPC TCP sockets always have permission checks applied.

Approving to land - please get this on the b2g18 relbranch as per https://wiki.mozilla.org/Release_Management/B2G_Landing#v1.0.0_2

Comment 8

[Lukas Blakk [:lsblakk] use ?needinfo]

(In reply to Lukas Blakk [:lsblakk] from comment #7)
> Comment on attachment 706776 [details] [diff] [review]

please get this on the b2g18_v_1_0_0 branch - not relbranch, my bad.

Comment 9

[Josh Matthews [:jdm]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/770b5184d683
https://hg.mozilla.org/releases/mozilla-b2g18/rev/1ed910d7b562
https://hg.mozilla.org/releases/mozilla-b2g18_v1_0_0/rev/d45ab6621cf3

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/770b5184d683

Comment 11

[Lukas Blakk [:lsblakk] use ?needinfo]

Batch edit: Bugs fixed on b2g18 after 1/25 merge to v1.0 branch are fixed on v1.0.1 branch.