New issue
Advanced search Search tips

Issue 608156 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: May 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: Heap-use-after-free in MessagingBindings::DispatchOnConnect

Project Member Reported by rob@robwu.nl, Apr 30 2016

Issue description

Chrome version: 50.0.2661.75

MessagingBindings::DispatchOnConnect dereferences a RenderFrame pointer right after running scripts in that frame. The scripts may invalidate that pointer, resulting in a UAF.

To reproduce: Load the attached extension. It will open a new tab, set up an onConnect listener and trigger this listener. The resulting symbolized ASAN log is also attached.


NOTE: This report is not elligible for the reward program because I authored the patch that introduced this vulnerability in Chrome 49: https://chromium.googlesource.com/chromium/src/+blame/f6f806674c4f6ebbb8b20197ae5b6c7a40bba08f/extensions/renderer/messaging_bindings.cc#458
 
asan-onConnect-50.0.2661.75.log
18.4 KB View Download
manifest.json
306 bytes View Download
background.js
277 bytes View Download
contentscript.js
325 bytes View Download
Labels: Security_Severity-High Security_Impact-Stable M-50 Pri-1
Project Member

Comment 3 by bugdroid1@chromium.org, May 2 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/02aac0ffcff2e9830e0c9e0bdcc34b45fb666fcf

commit 02aac0ffcff2e9830e0c9e0bdcc34b45fb666fcf
Author: rob <rob@robwu.nl>
Date: Mon May 02 17:07:47 2016

Determine routing ID before potentially invalidating the frame

BUG= 608156 

Review-Url: https://codereview.chromium.org/1931253004
Cr-Commit-Position: refs/heads/master@{#390971}

[modify] https://crrev.com/02aac0ffcff2e9830e0c9e0bdcc34b45fb666fcf/extensions/renderer/messaging_bindings.cc

Comment 4 by rob@robwu.nl, May 3 2016

Labels: Merge-Request-51
Status: Fixed (was: Started)

Comment 5 by tin...@google.com, May 3 2016

Labels: -Merge-Request-51 Merge-Approved-51 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M51 (branch: 2704)
Please merge your change to M51 branch 2704 by 4:00 PM PST today so we can take it for this week beta release tomorrow.Thank you.
Project Member

Comment 7 by ClusterFuzz, May 3 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 8 by bugdroid1@chromium.org, May 3 2016

Labels: -merge-approved-51 merge-merged-2704
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2cdf32b96d5729e9be91d49cc8898c6470759962

commit 2cdf32b96d5729e9be91d49cc8898c6470759962
Author: Rob Wu <rob@robwu.nl>
Date: Tue May 03 21:26:37 2016

Determine routing ID before potentially invalidating the frame

BUG= 608156 

Review-Url: https://codereview.chromium.org/1931253004
Cr-Commit-Position: refs/heads/master@{#390971}
(cherry picked from commit 02aac0ffcff2e9830e0c9e0bdcc34b45fb666fcf)

Review URL: https://codereview.chromium.org/1951583002 .

Cr-Commit-Position: refs/branch-heads/2704@{#363}
Cr-Branched-From: 6e53600def8f60d8c632fadc70d7c1939ccea347-refs/heads/master@{#386251}

[modify] https://crrev.com/2cdf32b96d5729e9be91d49cc8898c6470759962/extensions/renderer/messaging_bindings.cc

Labels: reward-topanel

Comment 10 by rob@robwu.nl, May 29 2016

Labels: -M-50 M-51
Labels: Release-1-M51
Labels: -reward-topanel reward-ineligible
Ah, missed your comment in the OP about eligibility. Updating labels.

We'll reference this with the "internal fixes" section in the next M51 release.
Project Member

Comment 13 by sheriffbot@chromium.org, Aug 9 2016

Labels: -Restrict-View-SecurityNotify
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 14 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 15 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic

Sign in to add a comment