New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 779364 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: SwiftShader sw::Renderer::taskLoop

Reported by om...@krash.in, Oct 28 2017

Issue description

I have tested this vulnerability on Windows 10 and Windows ASAN build asan-coverage-win32-release-506366 and asan-win32-release-512393

2ff217c7 f30f7e0c10      movq    xmm1,mmword ptr [eax+edx] ds:002b:23d73000=????????????????
5:118:x86> k
 # ChildEBP RetAddr  
WARNING: Frame IP not in any known module. Following frames may be wrong.
00 2d26fb08 0e400210 0x2ff217c7
*** WARNING: Unable to verify checksum for C:\Users\omair\Desktop\asan-win32-release-509608\swiftshader\libglesv2.dll
01 2d26fb50 525a7161 0xe400210
02 2d26fb70 525a702c libglesv2!sw::Renderer::taskLoop+0x4f [C:\b\c\b\win_asan_release\src\third_party\swiftshader\src\Renderer\Renderer.cpp @ 726] 
03 2d26fba4 525a6f7e libglesv2!sw::Renderer::threadLoop+0x7e [C:\b\c\b\win_asan_release\src\third_party\swiftshader\src\Renderer\Renderer.cpp @ 716] 
04 2d26fbbc 52a5bc0f libglesv2!sw::Renderer::threadFunction+0x54 [C:\b\c\b\win_asan_release\src\third_party\swiftshader\src\Renderer\Renderer.cpp @ 708] 
*** WARNING: Unable to verify checksum for chrome.exe
05 2d26fbd4 0157ea72 libglesv2!sw::Thread::startFunction+0x5d [C:\b\c\b\win_asan_release\src\third_party\swiftshader\src\Common\Thread.cpp @ 58] 
06 2d26fbe8 0157da5e chrome!__asan::AsanThread::ThreadStart+0x92 [e:\b\build\slave\win_upload_clang\build\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_thread.cc @ 267] 
07 2d26fbf8 759f8744 chrome!asan_thread_start+0x1e [e:\b\build\slave\win_upload_clang\build\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_win.cc @ 137] 
08 2d26fc0c 772e582d KERNEL32!BaseThreadInitThunk+0x24
09 2d26fc54 772e57fd ntdll_77280000!__RtlUserThreadStart+0x2f
0a 2d26fc64 00000000 ntdll_77280000!_RtlUserThreadStart+0x1b


The asan builds seem to be having some problem currently on Windows and can't get the symbolized stack trace
==13916==ERROR: AddressSanitizer: access-violation on unknown address 0x233d3000 (pc 0x2f5e17c7 bp 0x2c4df764 sp 0x2c4df370 T37)
    #0 0x2f5e17c6  (<unknown module>)
    #1 0xd70720f  (<unknown module>)
    #2 0x5275a002  (c:\Users\omair\Desktop\asan-win32-release-512393\swiftshader\libglesv2.dll+0x1041a002)
    #3 0x52759ecd  (c:\Users\omair\Desktop\asan-win32-release-512393\swiftshader\libglesv2.dll+0x10419ecd)
    #4 0x52759e1f  (c:\Users\omair\Desktop\asan-win32-release-512393\swiftshader\libglesv2.dll+0x10419e1f)

 
Chrome_swshader.html
3.1 KB View Download
Components: Internals>GPU>SwiftShader
Project Member

Comment 2 by ClusterFuzz, Oct 30 2017

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=5370139066499072.
Project Member

Comment 3 by ClusterFuzz, Oct 31 2017

Labels: OS-Windows

Comment 4 by palmer@chromium.org, Oct 31 2017

Cc: nicolasc...@google.com vmi...@chromium.org kbr@chromium.org
Owner: jbau...@chromium.org
Status: Assigned (was: Unconfirmed)
jbauman, do you still work on GPU stuff, and SwiftShader in particular? If not, can you please recommend a better person to take this bug? Thanks!

Also, this might affect more platforms besides Windows? Including Fuchsia?

Comment 5 by kbr@chromium.org, Oct 31 2017

Cc: sugoi@chromium.org
Owner: capn@chromium.org
Project Member

Comment 6 by ClusterFuzz, Oct 31 2017

Labels: Security_Severity-Medium Security_Impact-Head
Detailed report: https://clusterfuzz.com/testcase?key=5370139066499072

Job Type: windows_asan_chrome
Crash Type: UNKNOWN READ
Crash Address: 0x0dab2000
Crash State:
  Register
  Register
  Register
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=512219:512265

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5370139066499072

See https://github.com/google/clusterfuzz-tools for more information.

A recommended severity was added to this bug. Please change the severity if it is inaccurate.

Project Member

Comment 7 by sheriffbot@chromium.org, Oct 31 2017

Labels: M-64
Project Member

Comment 8 by sheriffbot@chromium.org, Oct 31 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 9 by sheriffbot@chromium.org, Oct 31 2017

Labels: Pri-1

Comment 10 by capn@chromium.org, Nov 2 2017

Cc: capn@chromium.org
Owner: sugoi@chromium.org
Status: Started (was: Assigned)
Alexis has started looking into this.
Project Member

Comment 11 by bugdroid1@chromium.org, Nov 2 2017

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/7a8ed2e14ad40356a624826df166c41fec7e2525

commit 7a8ed2e14ad40356a624826df166c41fec7e2525
Author: Alexis Hetu <sugoi@google.com>
Date: Thu Nov 02 15:32:24 2017

Prevent initializing outline edges to out of bound values

When multisampling is enabled, outline edges were getting
initialized to one of the  primitive's X position. If the
primitive was out of bounds, then the default position was
out of bounds, which led to an initial out of bounds memory
access.

Added a clamp to fix the issue.

 Bug chromium:779364 

Change-Id: I4661f4229ee28a3032c763ed18dde799d3c3926b
Reviewed-on: https://swiftshader-review.googlesource.com/13528
Tested-by: Alexis Hétu <sugoi@google.com>
Reviewed-by: Nicolas Capens <nicolascapens@google.com>

[modify] https://crrev.com/7a8ed2e14ad40356a624826df166c41fec7e2525/src/Shader/SetupRoutine.cpp

Cc: mmoroz@chromium.org
Labels: reward-topanel
omair@, out of curiosity, what techniques have you used to find that issue?
Hm, it seems to be a duplicate of  issue 779325 .

Comment 14 by om...@krash.in, Nov 16 2017

#c12:
Fuzzing (you can stop reading here) with ML and AI (Cyber). On my own built up, cloud based, state of the art, fuzzing infrastructure aka two instances of Chrome.

Thanks for your answer, I wish we could give rewards for awesome bugs comments.

Regarding duplication, I'll defer to the bug owner to decide that. Either way, looking forward to seeing more reports from you :)
Project Member

Comment 16 by ClusterFuzz, Nov 17 2017

Detailed report: https://clusterfuzz.com/testcase?key=5370139066499072

Job Type: windows_asan_chrome
Crash Type: UNKNOWN READ
Crash Address: 0x0dab2000
Crash State:
  Register
  Register
  Register
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=512219:512265

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5370139066499072

See https://github.com/google/clusterfuzz-tools for more information.
Project Member

Comment 17 by ClusterFuzz, Dec 2 2017

ClusterFuzz has detected this issue as fixed in range 521083:521102.

Detailed report: https://clusterfuzz.com/testcase?key=5370139066499072

Job Type: windows_asan_chrome
Crash Type: UNKNOWN READ
Crash Address: 0x0dab2000
Crash State:
  Register
  Register
  Register
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=512219:512265
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=521083:521102

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5370139066499072

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 18 by ClusterFuzz, Dec 2 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 5370139066499072 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 19 by sheriffbot@chromium.org, Dec 2 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: -reward-topanel reward-unpaid reward-1000
*** Boilerplate reminders! ***
Please do NOT publicly disclose details until a fix has been released to all our users. Early public disclosure may cancel the provisional reward. Also, please be considerate about disclosure when the bug affects a core library that may be used by other products. Please do NOT share this information with third parties who are not directly involved in fixing the bug. Doing so may cancel the provisional reward. Please be honest if you have already disclosed anything publicly or to third parties. Lastly, we understand that some of you are not interested in money. We offer the option to donate your reward to an eligible charity. If you prefer this option, let us know and we will also match your donation - subject to our discretion. Any rewards that are unclaimed after 12 months will be donated to a charity of our choosing.
*********************************
omair@ - Groovy! The VRP Panel decided to award $1,000 for this report. Thanks!
Labels: -reward-unpaid reward-inprocess
Project Member

Comment 23 by sheriffbot@chromium.org, Mar 10 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 24 by sheriffbot@chromium.org, Mar 27 2018

Labels: -Security_Impact-Head -M-64 M-65 Security_Impact-Stable
Labels: -ReleaseBlock-Stable

Sign in to add a comment