New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 610337 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
please use my google.com address
Closed: May 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-buffer-overflow in epoll_add

Project Member Reported by ClusterFuzz, May 9 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5049426703286272

Fuzzer: ipc_fuzzer_mut
Job Type: linux_asan_chrome_ipc
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 8
Crash Address: 0x61500002faf0
Crash State:
  epoll_add
  event_add
  base::MessagePumpLibevent::WatchFileDescriptor
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_ipc&range=392267:392268

Minimized Testcase (774.19 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95doQvWPwSXdL1OQw0vT13RtPYhLSoF0s2p_FkSR2Iul5nG1UI18J6Sb-LHcFVX5F-_1nk3nVqd99GWaM3ZYb_uJ3bpBE-nyBR6PPRDeHcuxyRKtmsEj06mS-Hrn5zwukuAofseDjVXZoeP_KkueFxkw4hEBCV_jFJLavBWMtZwAb-mYks

Filer: ochang

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: roc...@chromium.org
Status: Assigned (was: Available)
Looks like this is in the replay process for the IPC fuzzer, so may not be a real chromium bug. 

rockot, any ideas what is causing this one? Thanks.

Comment 2 by f...@chromium.org, May 10 2016

Labels: M-52
Project Member

Comment 3 by sheriffbot@chromium.org, May 10 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, May 10 2016

Labels: Pri-1
Components: Internals

Comment 6 by roc...@chromium.org, May 17 2016

Cc: amistry@chromium.org
+amistry FYI
Project Member

Comment 7 by bugdroid1@chromium.org, May 17 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1febcb4dfce7928a6d4bee93888bdb88bfa18ce4

commit 1febcb4dfce7928a6d4bee93888bdb88bfa18ce4
Author: rockot <rockot@chromium.org>
Date: Tue May 17 05:02:30 2016

[mojo-edk] Fix bootstrap NodeChannel Start/ShutDown race

If the parent bootstrap signals an error very early in
NodeController startup, it can be ShutDown() before
Start() is invoked on the IO thread via
ConnectoToParentOnIOThread.

This changes Start() to gracefully handle a null
|channel_|.

BUG= 610337 
R=amistry@chromium.org

Review-Url: https://codereview.chromium.org/1985993002
Cr-Commit-Position: refs/heads/master@{#394055}

[modify] https://crrev.com/1febcb4dfce7928a6d4bee93888bdb88bfa18ce4/mojo/edk/system/node_channel.cc

Comment 8 by roc...@chromium.org, May 17 2016

Status: Fixed (was: Assigned)
I only was able to repro this rarely with local runs of the fuzzer+asan.

As far as I can tell, the most reasonable explanation for the bug is that StartOnIOThread must be called on an invalid ChannelPosix instance, and the CL above prevents the only possible code path I could find which might lead to this happening.

I have been unable to repro with the patch applied.

Please reopen this bug if ClusterFuzz remains unhappy.
Project Member

Comment 9 by ClusterFuzz, May 17 2016

Labels: Merge-Triage
Adding Merge-Triage label for tracking purposes.

Once your fix had sufficient bake time (on canary, dev as appropriate), please nominate your fix for merge by adding the Merge-Request-XX label, where XX is the Chrome milestone.

When your merge is approved by the release manager, please start merging with higher milestone label first. Make sure to re-request merge for every milestone in the label list. You can get branch information on omahaproxy.appspot.com.

Your fix is very close to the branch point. After the branch happens, please make sure to check if your fix is in.

- Your friendly ClusterFuzz
Project Member

Comment 10 by sheriffbot@chromium.org, May 18 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: -Merge-Triage Merge-Request-51
I think the baking has been sufficient.

Comment 12 by tin...@google.com, May 18 2016

Labels: -Merge-Request-51 Merge-Review-51 Hotlist-Merge-Review
[Automated comment] Less than 2 weeks to go before stable on M51, manual review required.
Cc: sshruthi@chromium.org
Labels: -Merge-Review-51 Merge-Approved-51
Approving merge to M51 branch 2704 based on comment #11. Please merge ASAP as we're getting very close to M51 stable promotion.
Project Member

Comment 14 by bugdroid1@chromium.org, May 18 2016

Labels: -merge-approved-51 merge-merged-2704
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9075528e0b9897b4775e764cacfff08b0eb79979

commit 9075528e0b9897b4775e764cacfff08b0eb79979
Author: Ken Rockot <rockot@chromium.org>
Date: Wed May 18 21:53:35 2016

[mojo-edk] Fix bootstrap NodeChannel Start/ShutDown race

If the parent bootstrap signals an error very early in
NodeController startup, it can be ShutDown() before
Start() is invoked on the IO thread via
ConnectoToParentOnIOThread.

This changes Start() to gracefully handle a null
|channel_|.

BUG= 610337 
R=amistry@chromium.org

Review-Url: https://codereview.chromium.org/1985993002
Cr-Commit-Position: refs/heads/master@{#394055}
(cherry picked from commit 1febcb4dfce7928a6d4bee93888bdb88bfa18ce4)

Review URL: https://codereview.chromium.org/1995723003 .

Cr-Commit-Position: refs/branch-heads/2704@{#589}
Cr-Branched-From: 6e53600def8f60d8c632fadc70d7c1939ccea347-refs/heads/master@{#386251}

[modify] https://crrev.com/9075528e0b9897b4775e764cacfff08b0eb79979/mojo/edk/system/node_channel.cc

Labels: Merge-Request-50
Cc: tinazh@chromium.org
Labels: -Merge-Request-50 Merge-Rejected-50
There won't be any M50 releases as we're very close to M51 stable promotion.
Project Member

Comment 17 by sheriffbot@chromium.org, Aug 23 2016

Labels: -Restrict-View-SecurityNotify
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 18 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 19 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic

Sign in to add a comment