ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=5820046757330944.

dmazzoni@ - could you take a peek at this as it seems accessibility related? Feel free to re-assign as appropriate, or bounce back to me if unrelated. Thanks!

Does it mean the ClusterFuzz has discovered this vulnerability before?

We have reduced this case in case you need it

Deleted: Poc.html 1.8 KB

Poc.html 1.8 KB View Download

dmazzoni: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6632606331043840.

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6523108555751424.

dmazzoni@, this is a high severity security bug affecting stable, please take a look as per c#2.

hi, 

Any updates? or do you need we provide some extra info?

I'm unable to reproduce on Linux ToT with ASAN. Clusterfuzz also says unreproducible.

I can maybe try the version above, and I can try on Windows.

I just rechecked it and this may still there in the latest stable version of 66.0.3359.181.
4:041> lmvm chrome_child
start    end        module name
64a50000 688a6000   chrome_child   (export symbols)       C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.
    Loaded symbol image file: C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.181\chrome_child.dll
    Image path: C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.181\chrome_child.dll
    Image name: chrome_child.dll
    Timestamp:        Tue May 15 10:58:10 2018 (5AFA4CC2)
    CheckSum:         03CF20C3
    ImageSize:        03E56000
    File version:     66.0.3359.181
    Product version:  66.0.3359.181
    File flags:       0 (Mask 17)
    File OS:          4 Unknown Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Google Inc.
    ProductName:      Google Chrome
    InternalName:     chrome_dll
    OriginalFilename: chrome.dll
    ProductVersion:   66.0.3359.181
    FileVersion:      66.0.3359.181
    FileDescription:  Google Chrome
    LegalCopyright:   Copyright 2017 Google Inc. All rights reserved.

The following is the command I use to reproduce(I use Math.cos to debug so I added some breakpoints there,delete them if you don't need)
"C:\Users\Puzzor\Desktop\Debugging Tools for Windows (x86)\cdb.exe" -c ".childdbg 1;g;g;g;g;bu chrome_child!v8::base::ieee754::cos \"dd esp L3;g;\";bu chrome_child!ui::ClientTreeNode::~ClientTreeNode \"r ecx;.echo \\"freed\\";g\";bu chrome_child!ui::ClientTreeNode::ClientTreeNode \"r ecx;.echo \\"created\\";g\";.sympath cache*c:\mysymbol;"  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --force-renderer-accessibility --no-sandbox C:\Users\Puzzor\Desktop\PoC.html 

Did you forget the commandline "--force-renderer-accessibility"? this is important to reproduce the case

I used that command line. Have you tested it on anything more recent than 66 or on any other platform?

Does it crash when no memory debuggers are running? Or does it trigger a silent UAF that doesn't usually crash?

nope, I only tested on the latest version so far.

yes, it will crash even without debuggers. BUT when I tried to analyze it with debugger,sometimes it crashes with strange context(but I think the root cause is a UAF?):

###########################################################################
(e0c.ce0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000064 ebx=0031eb78 ecx=0565a2e0 edx=0565a2d0 esi=0031ebb0 edi=055fddbc
eip=612395bd esp=0031eb64 ebp=0031eba0 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.181\chrome_child.dll -
chrome_child!IsSandboxedProcess+0x593695:
612395bd 8b4008          mov     eax,dword ptr [eax+8] ds:002b:0000006c=????????
###########################################################################
(e14.c98): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000001 ebx=001be710 ecx=054079ec edx=054079e0 esi=001be748 edi=042ce0cc
eip=681395bd esp=001be6fc ebp=001be738 iopl=0         nv up ei pl nz ac pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.181\chrome_child.dll -
chrome_child!IsSandboxedProcess+0x593695:
681395bd 8b4008          mov     eax,dword ptr [eax+8] ds:002b:00000009=????????

BTW, if you cannot reproduce it at first time, try to refresh the page, sometimes you need to refresh it 2 or 3 times to trigger, but in general, the first time you open it will trigger the crash

Can you reproduce it now?

Any updates?

Still no updates?

dmazzoni: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Doug, maybe there's someone else in your org who might have time to take a stab at this besides Dominic?

Almost 2 months after we submitted this bug, you still have no time to verify it? Plz take time to look at it. We will disclose it after 90 days by default, if you have any problems reproducing it plz let us know. Thank you very much

I attempted to reproduce this using the poc without any success this morning. 

puzzorsj@gmail.com:

if I simply load the poc.html with the accessibility flag set, should I see a crash or something in the debugger?  Or specifically, is this potential UAF triggerable without extra debugging tooling.

What version did you try? I just tried the latest version and it cannot be reproduced.
But you can see, when we first opened this issue on May 3, the stable version at then was 66.0.3359.1xx, on May 25, I could also reproduce this issue, to prove this, I uploaded a video in case you need it.
The following is the shared link:
https://drive.google.com/open?id=10CTYKFtVSR80P52WBKSlFv46EbCdbPAD

Yes, I could reproduce with the same version you used in your initial comment:

>	content.dll!ui::AXTreeSerializer<blink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData>::LeastCommonAncestor(blink::WebAXObject node, ui::ClientTreeNode * client_node) Line 236	C++
 	content.dll!ui::AXTreeSerializer<blink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData>::LeastCommonAncestor(blink::WebAXObject node) Line 269	C++
 	content.dll!ui::AXTreeSerializer<blink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData>::SerializeChanges(blink::WebAXObject node, ui::AXTreeUpdateBase<content::AXContentNodeData,content::AXContentTreeData> * out_update) Line 335	C++
 	content.dll!content::RenderAccessibilityImpl::SendPendingAccessibilityEvents() Line 453	C++
 	content.dll!content::RenderAccessibilityImpl::OnEventsAck(int ack_token) Line 637	C++
 	content.dll!base::DispatchToMethodImpl<content::RenderAccessibilityImpl *,void (content::RenderAccessibilityImpl::*)(int) __attribute__((thiscall)),std::tuple<int>,0>(content::RenderAccessibilityImpl * const & obj, void(content::RenderAccessibilityImpl::*)(int) method, std::tuple<int> && args, std::integer_sequence<unsigned int,0>) Line 53	C++
 	content.dll!base::DispatchToMethod<content::RenderAccessibilityImpl *,void (content::RenderAccessibilityImpl::*)(int) __attribute__((thiscall)),std::tuple<int> >(content::RenderAccessibilityImpl * const & obj, void(content::RenderAccessibilityImpl::*)(int) method, std::tuple<int> && args) Line 60	C++
 	content.dll!IPC::DispatchToMethod<content::RenderAccessibilityImpl,void (content::RenderAccessibilityImpl::*)(int) __attribute__((thiscall)),void,std::tuple<int> >(content::RenderAccessibilityImpl * obj, void(content::RenderAccessibilityImpl::*)(int) method, void *, std::tuple<int> && tuple) Line 51	C++
 	content.dll!IPC::MessageT<AccessibilityMsg_Events_ACK_Meta,std::tuple<int>,void>::Dispatch<content::RenderAccessibilityImpl,content::RenderAccessibilityImpl,void,void (content::RenderAccessibilityImpl::*)(int) __attribute__((thiscall))>(const IPC::Message * msg, content::RenderAccessibilityImpl * obj, content::RenderAccessibilityImpl * sender, void * parameter, void(content::RenderAccessibilityImpl::*)(int) func) Line 147	C++
 	content.dll!content::RenderAccessibilityImpl::OnMessageReceived(const IPC::Message & message) Line 188	C++
 	content.dll!content::RenderFrameImpl::OnMessageReceived(const IPC::Message & msg) Line 1719	C++
 	ipc.dll!IPC::MessageRouter::RouteMessage(const IPC::Message & msg) Line 56	C++
 	content.dll!content::ChildThreadImpl::ChildThreadMessageRouter::RouteMessage(const IPC::Message & msg) Line 363	C++
 	ipc.dll!IPC::MessageRouter::OnMessageReceived(const IPC::Message & msg) Line 48	C++
 	content.dll!content::ChildThreadImpl::OnMessageReceived(const IPC::Message & msg) Line 731	C++
 	content.dll!content::RenderThreadImpl::OnMessageReceived(const IPC::Message & msg) Line 1694	C++
 	ipc.dll!IPC::ChannelProxy::Context::OnDispatchMessage(const IPC::Message & message) Line 320	C++
 	ipc.dll!base::internal::FunctorTraits<void (IPC::ChannelProxy::Context::*)(const IPC::Message &) __attribute__((thiscall)),void>::Invoke<const scoped_refptr<IPC::ChannelProxy::Context> &,const IPC::Message &>(void(IPC::ChannelProxy::Context::*)(const IPC::Message &) method, const scoped_refptr<IPC::ChannelProxy::Context> & receiver_ptr, const IPC::Message & args) Line 447	C++
 	ipc.dll!base::internal::InvokeHelper<0,void>::MakeItSo<void (IPC::ChannelProxy::Context::*const &)(const IPC::Message &) __attribute__((thiscall)),const scoped_refptr<IPC::ChannelProxy::Context> &,const IPC::Message &>(void(IPC::ChannelProxy::Context::*)(const IPC::Message &) & functor, const scoped_refptr<IPC::ChannelProxy::Context> & args, const IPC::Message & args) Line 530	C++
 	ipc.dll!base::internal::Invoker<base::internal::BindState<void (IPC::ChannelProxy::Context::*)(const IPC::Message &) __attribute__((thiscall)),scoped_refptr<IPC::ChannelProxy::Context>,IPC::Message>,void ()>::RunImpl<void (IPC::ChannelProxy::Context::*const &)(const IPC::Message &) __attribute__((thiscall)),const std::tuple<scoped_refptr<IPC::ChannelProxy::Context>,IPC::Message> &,0,1>(void(IPC::ChannelProxy::Context::*)(const IPC::Message &) & functor, const std::tuple<scoped_refptr<IPC::ChannelProxy::Context>,IPC::Message> & bound, std::integer_sequence<unsigned int,0,1>) Line 604	C++
 	ipc.dll!base::internal::Invoker<base::internal::BindState<void (IPC::ChannelProxy::Context::*)(const IPC::Message &) __attribute__((thiscall)),scoped_refptr<IPC::ChannelProxy::Context>,IPC::Message>,void ()>::Run(base::internal::BindStateBase * base) Line 586	C++
 	base.dll!base::OnceCallback<void ()>::Run() Line 95	C++
 	base.dll!base::debug::TaskAnnotator::RunTask(const char * queue_function, base::PendingTask * pending_task) Line 61	C++
 	blink_platform.dll!blink::scheduler::internal::ThreadControllerImpl::DoWork(blink::scheduler::internal::Sequence::WorkType work_type) Line 162	C++
 	blink_platform.dll!base::internal::FunctorTraits<void (blink::scheduler::internal::ThreadControllerImpl::*)(blink::scheduler::internal::Sequence::WorkType) __attribute__((thiscall)),void>::Invoke<const base::WeakPtr<blink::scheduler::internal::ThreadControllerImpl> &,const blink::scheduler::internal::Sequence::WorkType &>(void(blink::scheduler::internal::ThreadControllerImpl::*)(blink::scheduler::internal::Sequence::WorkType) method, const base::WeakPtr<blink::scheduler::internal::ThreadControllerImpl> & receiver_ptr, const blink::scheduler::internal::Sequence::WorkType & args) Line 447	C++
 	blink_platform.dll!base::internal::InvokeHelper<1,void>::MakeItSo<void (blink::scheduler::internal::ThreadControllerImpl::*const &)(blink::scheduler::internal::Sequence::WorkType) __attribute__((thiscall)),const base::WeakPtr<blink::scheduler::internal::ThreadControllerImpl> &,const blink::scheduler::internal::Sequence::WorkType &>(void(blink::scheduler::internal::ThreadControllerImpl::*)(blink::scheduler::internal::Sequence::WorkType) & functor, const base::WeakPtr<blink::scheduler::internal::ThreadControllerImpl> & weak_ptr, const blink::scheduler::internal::Sequence::WorkType & args) Line 553	C++
 	blink_platform.dll!base::internal::Invoker<base::internal::BindState<void (blink::scheduler::internal::ThreadControllerImpl::*)(blink::scheduler::internal::Sequence::WorkType) __attribute__((thiscall)),base::WeakPtr<blink::scheduler::internal::ThreadControllerImpl>,blink::scheduler::internal::Sequence::WorkType>,void ()>::RunImpl<void (blink::scheduler::internal::ThreadControllerImpl::*const &)(blink::scheduler::internal::Sequence::WorkType) __attribute__((thiscall)),const std::tuple<base::WeakPtr<blink::scheduler::internal::ThreadControllerImpl>,blink::scheduler::internal::Sequence::WorkType> &,0,1>(void(blink::scheduler::internal::ThreadControllerImpl::*)(blink::scheduler::internal::Sequence::WorkType) & functor, const std::tuple<base::WeakPtr<blink::scheduler::internal::ThreadControllerImpl>,blink::scheduler::internal::Sequence::WorkType> & bound, std::integer_sequence<unsigned int,0,1>) Line 604	C++
 	blink_platform.dll!base::internal::Invoker<base::internal::BindState<void (blink::scheduler::internal::ThreadControllerImpl::*)(blink::scheduler::internal::Sequence::WorkType) __attribute__((thiscall)),base::WeakPtr<blink::scheduler::internal::ThreadControllerImpl>,blink::scheduler::internal::Sequence::WorkType>,void ()>::Run(base::internal::BindStateBase * base) Line 586	C++
 	base.dll!base::OnceCallback<void ()>::Run() Line 95	C++
 	base.dll!base::debug::TaskAnnotator::RunTask(const char * queue_function, base::PendingTask * pending_task) Line 61	C++
 	base.dll!base::internal::IncomingTaskQueue::RunTask(base::PendingTask * pending_task) Line 124	C++
 	base.dll!base::MessageLoop::RunTask(base::PendingTask * pending_task) Line 395	C++
 	base.dll!base::MessageLoop::DeferOrRunPendingTask(base::PendingTask pending_task) Line 410	C++
 	base.dll!base::MessageLoop::DoWork() Line 451	C++
 	base.dll!base::MessagePumpDefault::Run(base::MessagePump::Delegate * delegate) Line 37	C++
 	base.dll!base::MessageLoop::Run(bool application_tasks_allowed) Line 346	C++
 	base.dll!base::RunLoop::Run() Line 133	C++
 	content.dll!content::RendererMain(const content::MainFunctionParams & parameters) Line 235	C++
 	content.dll!content::RunNamedProcessTypeMain(const std::basic_string<char,std::char_traits<char>,std::allocator<char> > & process_type, const content::MainFunctionParams & main_function_params, content::ContentMainDelegate * delegate) Line 423	C++
 	content.dll!content::ContentMainRunnerImpl::Run() Line 703	C++
 	content.dll!content::ContentServiceManagerMainDelegate::RunEmbedderProcess() Line 51	C++
 	embedder.dll!service_manager::Main(const service_manager::MainParams & params) Line 453	C++
 	content.dll!content::ContentMain(const content::ContentMainParams & params) Line 19	C++
 	chrome.dll!ChromeMain(HINSTANCE__ * instance, sandbox::SandboxInterfaceInfo * sandbox_info, __int64 exe_entry_point_ticks) Line 101	C++
 	chrome.exe!MainDllLoader::Launch(HINSTANCE__ * instance, base::TimeTicks exe_entry_point_ticks) Line 199	C++
 	chrome.exe!wWinMain(HINSTANCE__ * instance, HINSTANCE__ * prev, wchar_t *, int) Line 230	C++


This crash appears to be the same one as in Bug 704045.

Duplicate one? I have no permission to view issue 704045, could you please take a look when that issue was opened?

The code change in that issue I mentioned is:
     https://chromium.googlesource.com/chromium/src.git/+/898335c93b9fd3adfa8f9a75c1b65cd4c153161d

Thanks

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot