New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 43307 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Email to this user bounced
Closed: May 2010
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug-Security
M-5

Restricted
  • Only users with EditIssue permission may comment.



Sign in to add a comment

[MD audit] Possible memory corruption with bad bitmap shared memory object in clipboard IPC

Reported by scarybea...@gmail.com, May 5 2010

Issue description

---
1. Command Buffer Service Integer Overflow

File: app/clipboard/clipboard.cc
Function: Clipboard::DispatchObject()
Problem Type: Type Confusion
Compromise Type: Varies
Severity: High
Message: ViewHostMsg_ClipboardWriteObjectsAsync

The DispatchObject() function reads a series of clipboard objects from the 
untrusted renderer process and stores them in the clipboard object in the 
browser 
process. One particular object type, CBF_SMBITMAP, contains a vector<char> 
input parameter, whose contents are simply interpreted as a pointer to a 
SharedMemory object (ie. the character buffer's contents are really a 
pointer, not a byte stream). Normally, this would be a dangerous operation, 
as an 
arbitrary pointer supplied by the untrusted renderer process could be 
misinterpreted leading to potential illegal memory accesses and so forth. 
However, the 
renderer ordinarily doesn't supply this pointer directly. Instead, that 
parameter is replaced on the browser side in 
Clipboard::ReplaceSharedMemHandle() with 
a pointer to an object created within the browser process. However, 
ClipboardReplaceSharedMemHandle() is only called when processing the 
ViewHostMsg_ClipboardWriteObjectsSync message, not when processing 
ViewHostMsg_ClipboardWriteObjectsAsync messages. Therefore, if CBF_SMBITMAP 
objects are 
included in a ViewHostMsg_ClipboardWriteObjectsAsync message, no 
replacement is done on the input parameters, hence allowing the renderer to 
supply an 
arbitrary SharedMemoryHandle pointer. This can potentially lead to illegal 
memory accesses and arbitrary execution.
---
 
The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=46639 

------------------------------------------------------------------------
r46639 | cevans@chromium.org | 2010-05-06 16:11:30 -0700 (Thu, 06 May 2010) | 6 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/trunk/src/chrome/browser/renderer_host/resource_message_filter.cc?r1=46639&r2=46638

Handle CBF_SMBITMAP in the async version of the IPC.

BUG= 43307 
TEST=NONE

Review URL: http://codereview.chromium.org/1973002
------------------------------------------------------------------------

Labels: Mstone-5 MergeNeeded
Status: FixUnreleased
Labels: -MergeNeeded NeedsMerge

Comment 5 by jsc...@chromium.org, May 24 2010

Labels: -Pri-0 Pri-1
Labels: -NeedsMerge
Merge comments didn't come automatically, so adding it manually.

Merge 46639 - Handle CBF_SMBITMAP in the async version of the IPC.

BUG= 43307 
TEST=NONE

Review URL: http://codereview.chromium.org/1973002

TBR=cevans@chromium.org

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=48054

Comment 7 by bugdro...@gmail.com, May 24 2010

The following revision refers to this bug:
    http://src.chromium.org/viewvc/chrome?view=rev&revision=48054 

------------------------------------------------------------------------
r48054 | inferno@chromium.org | 2010-05-24 10:51:40 -0700 (Mon, 24 May 2010) | 9 lines
Changed paths:
   M http://src.chromium.org/viewvc/chrome/branches/375/src/chrome/browser/renderer_host/resource_message_filter.cc?r1=48054&r2=48053

Merge 46639 - Handle CBF_SMBITMAP in the async version of the IPC.

BUG= 43307 
TEST=NONE

Review URL: http://codereview.chromium.org/1973002

TBR=cevans@chromium.org
Review URL: http://codereview.chromium.org/2125022
------------------------------------------------------------------------

Labels: -Restrict-View-SecurityTeam
Status: Fixed
Fixed in 5.0.375.70

Comment 9 by jsc...@chromium.org, Mar 21 2011

Labels: Type-Security
Labels: SecImpacts-Stable
Batch update.
Project Member

Comment 11 by bugdroid1@chromium.org, Oct 13 2012

Labels: Restrict-AddIssueComment-Commit
This issue has been closed for some time. No one will pay attention to new comments.
If you are seeing this bug or have new data, please click New Issue to start a new bug.
Project Member

Comment 12 by bugdroid1@chromium.org, Mar 10 2013

Labels: -SecSeverity-High -Mstone-5 -Type-Security -SecImpacts-Stable M-5 Security-Impact-Stable Security-Severity-High Type-Bug-Security
Project Member

Comment 13 by bugdroid1@chromium.org, Mar 11 2013

Labels: -Area-Undefined
Project Member

Comment 14 by bugdroid1@chromium.org, Mar 13 2013

Labels: -Restrict-AddIssueComment-Commit Restrict-AddIssueComment-EditIssue
Project Member

Comment 15 by bugdroid1@chromium.org, Mar 21 2013

Labels: -Security-Severity-High Security_Severity-High
Project Member

Comment 16 by bugdroid1@chromium.org, Mar 21 2013

Labels: -Security-Impact-Stable Security_Impact-Stable
Project Member

Comment 17 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 18 by sheriffbot@chromium.org, Oct 1 2016

Labels: Restrict-View-SecurityNotify
Project Member

Comment 19 by sheriffbot@chromium.org, Oct 2 2016

Labels: -Restrict-View-SecurityNotify
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic

Sign in to add a comment