New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 603732 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: Heap-use-after-free via GCCallback

Project Member Reported by rob@robwu.nl, Apr 14 2016

Issue description

Chrome version: 52.0.2709.0 and earlier

GCCallback in extensions/renderer/gc_callback.cc contains a UAF vulnerability that can be controlled with high precision (=arbitrary JS execution before the first delete, before the second delete, and after the second delete).


Here is how the vulnerability works:
1. Construct a GCCallback::RunCallback in a frame (there are multiple ways to do that, https://cs.chromium.org/BindToGC). 
2. While the JS callback is run, remove the frame (invalidating the JavaScript context in the process).
3. GCCallback::OnContextInvalidated is triggered because of 2.
4. Step 3 deletes |this|.
5. Now the JS function from step 2 returns, and control goes back to step 1.
6. Step 1 deletes |this| again. = double-free.

Combined with  bug 603725  or bug 591164, this can be exploited by any web page without user interaction.
Without these bugs, this bug can still be exploited from any extension or app (without user interaction except installing the extension/app).


I've an ASAN trace generated with Chrome 49.0.2623.75 because I didn't build the latest stable (50) with ASAN yet. The vulnerable code is still present on master, so that shouldn't matter.
 
uaf-during-gc-callback50.html
10.2 KB View Download
heap-use-after-free-asan.log
14.7 KB View Download

Comment 1 by tsepez@chromium.org, Apr 15 2016

Labels: Security_Severity-High M-50 Security_Impact-Beta Pri-1
Owner: jochen@chromium.org
Status: Assigned (was: Unconfirmed)

Comment 2 by rob@robwu.nl, Apr 15 2016

Labels: -Security_Impact-Beta Security_Impact-Stable
This bug affects all channels.
Project Member

Comment 3 by bugdroid1@chromium.org, Apr 15 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/34c97b31e61e8329e19188b46a489412a16d2b63

commit 34c97b31e61e8329e19188b46a489412a16d2b63
Author: jochen <jochen@chromium.org>
Date: Fri Apr 15 12:03:12 2016

Don't execute the fallback if we already started running the gc callback

BUG= 603732 
R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1887423002

Cr-Commit-Position: refs/heads/master@{#387578}

[modify] https://crrev.com/34c97b31e61e8329e19188b46a489412a16d2b63/extensions/renderer/gc_callback.cc

Comment 4 by jochen@chromium.org, Apr 15 2016

Cc: rdevlin....@chromium.org
Status: Fixed (was: Assigned)
Project Member

Comment 5 by ClusterFuzz, Apr 15 2016

Labels: -Restrict-View-SecurityTeam Merge-Triage M-51 Restrict-View-SecurityNotify
Adding Merge-Triage label for tracking purposes.

Once your fix had sufficient bake time (on canary, dev as appropriate), please nominate your fix for merge by adding the Merge-Requested label.

When your merge is approved by the release manager, please start merging with higher milestone label first. Make sure to re-request merge for every milestone in the label list. You can get branch information on omahaproxy.appspot.com.

- Your friendly ClusterFuzz

Comment 6 by jochen@chromium.org, Apr 19 2016

Labels: Merge-Request-51

Comment 7 by tin...@google.com, Apr 19 2016

Labels: -Merge-Request-51 Merge-Approved-51 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M51 (branch: 2704)

Comment 8 by gov...@chromium.org, Apr 19 2016

We're VERY close to M51 beta candidate cut. Please merge your change to M51 branch 2704 asap. Thank you.
Project Member

Comment 9 by bugdroid1@chromium.org, Apr 20 2016

Labels: -merge-approved-51 merge-merged-2704
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9865e744d09069f6f6c39e8d351b87ab1dae9ef3

commit 9865e744d09069f6f6c39e8d351b87ab1dae9ef3
Author: Jochen Eisinger <jochen@chromium.org>
Date: Wed Apr 20 06:36:43 2016

Don't execute the fallback if we already started running the gc callback

BUG= 603732 
R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1887423002

Cr-Commit-Position: refs/heads/master@{#387578}
(cherry picked from commit 34c97b31e61e8329e19188b46a489412a16d2b63)

Review URL: https://codereview.chromium.org/1903123002 .

Cr-Commit-Position: refs/branch-heads/2704@{#142}
Cr-Branched-From: 6e53600def8f60d8c632fadc70d7c1939ccea347-refs/heads/master@{#386251}

[modify] https://crrev.com/9865e744d09069f6f6c39e8d351b87ab1dae9ef3/extensions/renderer/gc_callback.cc

Labels: Merge-Request-50

Comment 11 by tin...@google.com, Apr 21 2016

Labels: -Merge-Request-50 Merge-Review-50 Hotlist-Merge-Review
[Automated comment] Request affecting a post-stable build (M50), manual review required.
Before we approve merge to M50, Could you please confirm whether this bug is baked/verified in Canary and safe to merge? 
Yes, it has Canary coverage and is safe
Cc: tinazh@chromium.org
Labels: -Merge-Review-50 Merge-Approved-50
Approving merge to M50 branch 2661, based on comment #13. Please merge asap. Thank you.
Please merge your change to M50 branch 2661 before @1:00 PM PST tomorrow (Wednesday) so we can take it for this week Stable release.
Project Member

Comment 16 by bugdroid1@chromium.org, Apr 27 2016

Labels: -merge-approved-50 merge-merged-2661
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3692cce1b48f5d15b9813988207f8ee1f5c72c91

commit 3692cce1b48f5d15b9813988207f8ee1f5c72c91
Author: Jochen Eisinger <jochen@chromium.org>
Date: Wed Apr 27 06:58:55 2016

Don't execute the fallback if we already started running the gc callback

BUG= 603732 
R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1887423002

Cr-Commit-Position: refs/heads/master@{#387578}
(cherry picked from commit 34c97b31e61e8329e19188b46a489412a16d2b63)

Review URL: https://codereview.chromium.org/1925543002 .

Cr-Commit-Position: refs/branch-heads/2661@{#638}
Cr-Branched-From: ef6f6ae5e4c96622286b563658d5cd62a6cf1197-refs/heads/master@{#378081}

[modify] https://crrev.com/3692cce1b48f5d15b9813988207f8ee1f5c72c91/extensions/renderer/gc_callback.cc

Labels: -Merge-Triage reward-topanel Release-2-M50
Labels: -reward-topanel reward-3000 reward-unpaid CVE-2016-1662
Hey Rob - $3,000 for this report. I'll start payment today.

CVE-ID is CVE-2016-1662

Thanks as always!
Labels: -reward-unpaid reward-inprocess
Labels: -reward-inprocess
Project Member

Comment 21 by sheriffbot@chromium.org, Jul 22 2016

Labels: -Restrict-View-SecurityNotify
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 22 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 23 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic
Labels: CVE_description-submitted

Sign in to add a comment