846741 - OOM with document.write() of a large string

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

From: <[e-mail]>
To: "[e-mail]" <[e-mail]>
Subject: Firefox 19.0 Memory Corruption Vulnerability
Date: Mon, 25 Feb 2013 20:26:06 -0300
-----//-----
Hello Mozilla Security Team,

This time I have the honor to report to you a vulnerability "Mozilla Firefox 19.0 memory corruption".

Version affected: 19.0 (and previous)
Vulnerability:  Memory Corruption
Affected users: Remote
Comment: I enclose a video in which I show proof of concept, also exploit that an attacker would use to block Firefox remotely.

Best regards,
Fabián Cuchietti.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Attachment: Video

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Attachment: Exploit

Comment 3

[Fabian Cuchietti]

Affected all versions (0day).

Comment 4

[Andrew McCreight [:mccr8]]

Looks like either a JS problem or maybe some kind of character encoding thing.

Comment 5

[Andrew McCreight [:mccr8]]

What is the crash stack that you are getting?  You can see your recent crash reports in about:crashes.

Comment 6

[Fabian Cuchietti]

Here  my report from Crash: https://crash-stats.mozilla.com/report/index/9b58e445-2799-4ee6-b5a0-d0b612130226

Comment 7

[Boris Zbarsky [:bzbarsky]]

This looks like an out-of-memory crash to me.  The testcase is basically doing document.write() of a huge string.

Is there actually evidence of memory corruption here?

Comment 8

[Fabian Cuchietti]

You saw the video, my browser "FireFox" reaches +1,500,000 KB of memory, and falls ... Is not that memory corruption?

Comment 9

[Fabian Cuchietti]

Boris, my last  crash-report. 

https://crash-stats.mozilla.com/report/index/89546332-3cd4-49a0-8d17-653672130311

Comment 10

[Boris Zbarsky [:bzbarsky]]

Memory corruption is when the contents of memory are not what the program expects (which can cause it to do things to other files on the computer that are undesirable, for example).

In this case, all that happens is that we ask the operating system for more memory, it says there is no more, and we kill the process in a controlled manner precisely to avoid memory corruption.

> https://crash-stats.mozilla.com/report/index/89546332-3cd4-49a0-8d17-653672130311

Right.  So from that page, we have:

Available Virtual Memory	694255616
OOMAllocationSize	        154144768

So we asked the operating system for a single contiguous 154MB chunk of memory.  There were about 700MB of virtual memory available, but it was presumably somewhat fragmented, and the OS couldn't provide a single 154MB memory chunk.  It told us that, and we killed the process.

Comment 11

[Fabian Cuchietti]

not considered a vulnerability?

Comment 12

[Andrew McCreight [:mccr8]]

(In reply to Fabian Cuchietti from comment #11)
> not considered a vulnerability?

That's correct.  The crash report has mozalloc_handle_oom in it, which means the allocator tried allocate some memory, failed, and so the browser decided to exit in a safe manner.  This is done rather than trying to handle the error in a nicer manner, because those error paths are hard to test.

Comment 13

[Fabian Cuchietti]

Ok, also means that it's the same with "SeaMonkey", run the exploit in the search engine and crash in 30 seconds.