New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 768203 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug-Security
Team-Accessibility



Sign in to add a comment

Heap-use-after-free in blink::AXLayoutObject::GetDocument

Project Member Reported by ClusterFuzz, Sep 24 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5788119696932864

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x61100025afe0
Crash State:
  blink::AXLayoutObject::GetDocument
  blink::AXObjectCacheImpl::PostPlatformNotification
  blink::AXObjectCacheImpl::NotificationPostTimerFired
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=502229:502259

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5788119696932864

Additional requirements: Requires HTTP

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Sep 24 2017

Labels: M-63
Project Member

Comment 2 by sheriffbot@chromium.org, Sep 24 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Sep 24 2017

Labels: Pri-1

Comment 4 by palmer@chromium.org, Sep 25 2017

Cc: dmazz...@chromium.org aboxhall@chromium.org
Components: Blink>Accessibility
Owner: nek...@chromium.org
Status: Assigned (was: Untriaged)
nektar, could you please take a look at this, or pass it to someone better suited for it? Thanks!
 Issue 769581  has been merged into this issue.
Project Member

Comment 6 by ClusterFuzz, Oct 1 2017

Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
Labels: -Test-Predator-AutoComponents
Project Member

Comment 8 by sheriffbot@chromium.org, Oct 8 2017

nektar: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 9 by sheriffbot@chromium.org, Oct 18 2017

Labels: -Security_Impact-Head Security_Impact-Beta
Project Member

Comment 10 by sheriffbot@chromium.org, Oct 23 2017

nektar: Uh oh! This issue still open and hasn't been updated in the last 29 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 11 by ClusterFuzz, Oct 26 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5008410662928384 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 12 by sheriffbot@chromium.org, Oct 26 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 13 by ClusterFuzz, Oct 27 2017

Labels: OS-Linux
Project Member

Comment 14 by sheriffbot@chromium.org, Oct 28 2017

Labels: Merge-Request-63
Project Member

Comment 15 by sheriffbot@chromium.org, Oct 28 2017

Labels: -Merge-Request-63 Merge-Review-63 Hotlist-Merge-Review
This bug requires manual review: M63 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), gkihumba@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Cc: awhalley@chromium.org
I don't see any CL here to merge.

+ awhalley@ (Security TPM), could you ptal?
Cc: dougt@chromium.org
Hi dougt@ - there's an AX CL in the fix list - not immediately obvious at quick glance if it's related, mind taking a quick look to see if it might be (if so if it's a candidate for an M63 merge?)  Thanks!
Status: Available (was: Verified)
Where's the fix list?

Based on the minimized testcase, my guess is that this has been a longstanding bug but it's very hard to repro, and quite likely the testcase is very sensitive to tiny code changes.

So it's probably not really fixed, but it's going to require more work to figure out what's going on.

Or I could be wrong and this is just a symptom of some other bug that was fixed.

Comment 19 by dougt@chromium.org, Oct 31 2017

Could not repo on Windows this morning (although I do notice that the bug looks like it's only marked as Linux and Mac).
Project Member

Comment 20 by sheriffbot@chromium.org, Nov 1 2017

Status: Assigned (was: Available)
Project Member

Comment 21 by sheriffbot@chromium.org, Nov 1 2017

Status: Fixed (was: Assigned)
Please mark security bugs as fixed as soon as the fix lands, and before requesting merges. This update is based on the merge- labels applied to this issue. Please reopen if this update was incorrect.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -ReleaseBlock-Stable -ClusterFuzz-Verified -M-63 -Merge-Review-63 M-64 ClusterFuzz-Wrong
The (rather big) fix range is: https://chromium.googlesource.com/chromium/src/+log/6cb6e5c0e17babc4b68a2e4a2a628beff31b64d5..21c822a677b5424cba1219b3722c20f988208819?pretty=fuller&n=10000 which was from the duped  issue 769581 

I've just kicked off a few clusterfuzz retries 
Project Member

Comment 23 by ClusterFuzz, Nov 8 2017

Labels: Needs-Feedback
ClusterFuzz testcase 5788119696932864 is still reproducing on tip-of-tree build (trunk).

Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
Project Member

Comment 24 by sheriffbot@chromium.org, Feb 8 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 25 by sheriffbot@chromium.org, Mar 27 2018

Labels: -Security_Impact-Beta -M-64 M-65 Security_Impact-Stable

Sign in to add a comment