895010 - WebGL vertex array object security leak

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Guillaume Abadie]

Vertex array object has a bug with the vertex array fetching security checker. Hacker might be able to access not owned memory.

Comment 1

[Guillaume Abadie]

Attachment: patch disabling VAO extension

This patch disabled Vertex Array Object temporally.

Comment 2

[Jeff Muizelaar [:jrmuizel]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/97a092648a62

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

Comment on attachment 777245 [details] [diff] [review]
patch disabling VAO extension

Review of attachment 777245 [details] [diff] [review]:
-----------------------------------------------------------------

Would we tag the source (public) with a "this causes security problem" comment?

Comment 4

[Guillaume Abadie]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2d7edd0ded0e

Comment 5

[Guillaume Abadie]

The patch disabling WebGL's vertex array object extension has been of the reasons inbound close because of the associated WebGL conformance test passed when it was supposed to fail. Also I mixed up jgilbert and jrmuizel on the commit message. So sorry about that.

The bug is : We would be able to read GPU memory by the following sequence :
 - create a vertex array object 1 with one attribute binded on small vertex buffer object
 - create a vertex array object 2 with one attribute binded on a big vertex buffer
 - draw once with vertex array object 2
 - draw with vertex array object 1 but with a number of vertices bigger than the small vertex buffer => the vertex shader would get back all the GPU memory around the small vertex buffer location.

The problem has been found and being fixed by https://bugzilla.mozilla.org/show_bug.cgi?id=893180 bringing changes on WebGLContext::ValidateBuffer

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/97a092648a62

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/2d7edd0ded0e

Comment 8

[Al Billings [:abillings - ex-MoCo]]

Does this not affect 24 (and therefore ESR24) at all?

How about waaaaay back in ESR17?

If this affects older versions, we'll need an ESR24 (and probably ESR17) patch.

Comment 9

[Benoit Jacob [:bjacob] (mostly away)]

This only affects Gecko 25+. Earlier versions just didn't support vertex array objects.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Changing status flags from --- to unaffected for ESR since we explicitly know this.

Comment 11

[Robert Goulet]

Hi,

Could it be the reason why I am getting this in a WebGL2 context?

TypeError: Argument 1 of OES_vertex_array_object.bindVertexArrayOES does not implement interface WebGLVertexArrayObjectOES.