844211 - Only check the XBL bit if XBL scopes are disabled

Status: RESOLVED FIXED

(Core :: XBL, defect)

Description

[Bobby Holley (:bholley)]

This is one of the causes of bug 842255.

Because the old model of XBL detection uses stack introspection, it's possible to fool it using certain moz_bug_r_a4 tricks. This wasn't really a limiting security factor before XBL scopes, but now we care more because it can cause the XBL scope protections to be circumvented.

Fix should be straightforward. I'll whip it up now.

Comment 1

[Bobby Holley (:bholley)]

Attachment: Only check the XBL bit if XBL scopes are disabled. v1

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 717232 [details] [diff] [review]
Only check the XBL bit if XBL scopes are disabled. v1

r=me

Comment 3

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=c3cf535a3332

Comment 4

[Bobby Holley (:bholley)]

Attachment: Make this-object nativeCall special-casing actually do something. v1

Epic fail. :-(

Comment 5

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=759cf5bbb6e0

Comment 6

[Jason Orendorff [:jorendorff]]

Comment on attachment 720805 [details] [diff] [review]
Make this-object nativeCall special-casing actually do something. v1

Sorry I missed this on review.

Comment 7

[Bobby Holley (:bholley)]

The b-c failure in that last try push was related to the other patch in the same push. Otherwise, this looks more or less green.

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/06b6880a8241
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/c5a4010013ed

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/c5a4010013ed
https://hg.mozilla.org/mozilla-central/rev/06b6880a8241

Comment 9

[Bobby Holley (:bholley)]

Comment on attachment 717232 [details] [diff] [review]
Only check the XBL bit if XBL scopes are disabled. v1

[Approval Request Comment]
Bug caused by (feature/regressing bug #): These patches fix a hole in the security protections implemented by running XBL in a separate compartment (bug 834697), which is now on aurora. See bug 842255 for the details on the security flaw here. 
User impact if declined: The security benefits of XBL scopes can potentially be bypassed.
Testing completed (on m-c, etc.): Just landed on m-c.
Risk to taking this patch (and alternatives if risky): Not risky. No alternatives. 
String or UUID changes made by this patch: None

Comment 10

[Bobby Holley (:bholley)]

(This approval request applies to both patches).

Comment 11

[Daniel Veditz [:dveditz]]

bug 842255 affects ESR-17, but I suspect that this fix is not wanted there since the xbl scopes change (bug 834697) didn't land there.

Comment 12

[Bobby Holley (:bholley)]

Yes. bug 842255 is just another attack of the bug 816071 variety. The only thing that makes it special is that it can attack XBL scopes, which this patch fixes.

We still have no esr17 solution for the general case without landing XBL scopes there.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/21f6a4529d8a
https://hg.mozilla.org/releases/mozilla-aurora/rev/745cae64974c

Comment 14

[Al Billings [:abillings - ex-MoCo]]

How far back does this issue go? I assume we shipped 20 with it?

Comment 15

[Bobby Holley (:bholley)]

(In reply to Al Billings [:abillings] from comment #14)
> How far back does this issue go? I assume we shipped 20 with it?

No. The entire issue is not applicable to releases before bug 834697.