New issue
Advanced search Search tips

Issue 863933 link

Starred by 1 user
Status: Verified
Owner:
georgesak@chromium.org
Closed: Sep 25
Cc:
rogerta@chromium.org
zmin@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 1
Type: Bug



Sign in to add a comment

UAF in EnterpriseReportingPrivateUploadChromeDesktopReportFunction.

Project Member Reported by georgesak@chromium.org, Jul 16 
Problem is that as soon as we call Respond in EnterpriseReportingPrivateUploadChromeDesktopReportFunction::OnReportUploaded, we get deleted.

However, cloud_policy_client_ still has some cleaning to do.
Project Member

Comment 1 by bugdroid1@chromium.org, Jul 17 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c2eaf985001ee8b113f81fb5c94e111b287b94ed

commit c2eaf985001ee8b113f81fb5c94e111b287b94ed
Author: Georges Khalil <georgesak@chromium.org>
Date: Tue Jul 17 15:32:26 2018

Fix UAF in EnterpriseReportingPrivateUploadChromeDesktopReportFunction.

Delay the deletion of cloud_policy_client_ so it has time to clean up and avoid the UAF.

Change-Id: I57c3afef17f2e07cb89d9fb1e79641c964415b17
Bug:  863933 
Reviewed-on: https://chromium-review.googlesource.com/1138411
Reviewed-by: Owen Min <zmin@chromium.org>
Commit-Queue: Georges Khalil <georgesak@chromium.org>
Cr-Commit-Position: refs/heads/master@{#575648}
[modify] https://crrev.com/c2eaf985001ee8b113f81fb5c94e111b287b94ed/chrome/browser/extensions/api/enterprise_reporting_private/enterprise_reporting_private_api.cc
[modify] https://crrev.com/c2eaf985001ee8b113f81fb5c94e111b287b94ed/chrome/browser/extensions/api/enterprise_reporting_private/enterprise_reporting_private_api.h

Comment 2 by pastarmovj@chromium.org, Sep 25 

Is this done? Could this also be the reason this API crashed badly on ChromeOS?

Comment 3 by georgesak@chromium.org, Sep 25

Status: Verified (was: Started)
Yes this is fixed for Desktop.

No clue for ChromeOS, but could very well be if you tested before this fix.
►

Sign in to add a comment