PatchGap
Firefox · SpiderMonkey

CVE-2024-8389

Memory Corruption in SpiderMonkey
High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentSpiderMonkey
Bug ClassMemory Corruption
Tracker1907230
Fix commitb3e54698b3ad (firefox) +16/-3
CISA KEVNot listed
Creditedthe Mozilla Fuzzing Team, Andrew McCreight
Disclosed2024-09-03

Files Changed

  • js/xpconnect/crashtests/1907230.html
  • js/xpconnect/crashtests/crashtests.list
  • js/xpconnect/src/Sandbox.cpp
  • js/xpconnect/src/xpcprivate.h

Patch

view commit
diff --git a/js/xpconnect/crashtests/1907230.html b/js/xpconnect/crashtests/1907230.html
new file mode 100644
index 00000000000..9a72f688826
--- /dev/null
+++ b/js/xpconnect/crashtests/1907230.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+window.addEventListener("load", () => {
+  let a = new UIEvent("load", {"bubbles": true})
+  try { document.doctype.dispatchEvent(a) } catch (e) {}
+  document.write("<audio>")
+})
+</script>
diff --git a/js/xpconnect/crashtests/crashtests.list b/js/xpconnect/crashtests/crashtests.list
index 129c34db277..6cf1bf4e435 100644
--- a/js/xpconnect/crashtests/crashtests.list
+++ b/js/xpconnect/crashtests/crashtests.list
@@ -53,3 +53,4 @@ pref(dom.use_xbl_scopes_for_remote_xul,true) load 898939.html
 pref(security.fileuri.strict_origin_policy,false) load 938297.html
 load 977538.html
 load 1577573.html
+load 1907230.html
diff --git a/js/xpconnect/src/Sandbox.cpp b/js/xpconnect/src/Sandbox.cpp
index 0af438d7ce4..3dc7866929e 100644
--- a/js/xpconnect/src/Sandbox.cpp
+++ b/js/xpconnect/src/Sandbox.cpp
@@ -1500,7 +1500,10 @@ nsresult xpc::CreateSandboxObject(JSContext* cx, MutableHandleValue vp,
   // about:memory may use that information
   xpc::SetLocationForGlobal(sandbox, options.sandboxName);
 
-  xpc::SetSandboxMetadata(cx, sandbox, options.metadata);
+  nsresult rv = xpc::SetSandboxMetadata(cx, sandbox, options.metadata);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
 
   JSAutoRealm ar(cx, sandbox);
   JS_FireOnNewGlobalObject(cx, sandbox);
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 38d7516c361..ce7b60b3a72 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -2442,8 +2442,9 @@ nsresult EvalInSandbox(JSContext* cx, JS::HandleObject sandbox,
 nsresult GetSandboxMetadata(JSContext* cx, JS::HandleObject sandboxArg,
                             JS::MutableHandleValue rval);
 
-nsresult SetSandboxMetadata(JSContext* cx, JS::HandleObject sandboxArg,
-                            JS::HandleValue metadata);
+[[nodiscard]] nsresult SetSandboxMetadata(JSContext* cx,
+                                          JS::HandleObject sandboxArg,
+                                          JS::HandleValue metadata);
 
 bool CreateObjectIn(JSContext* cx, JS::HandleValue vobj,
                     CreateObjectInOptions& options,
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/js/xpconnect/crashtests/1907230.html b/js/xpconnect/crashtests/1907230.html
new file mode 100644
index 00000000000..9a72f688826
--- /dev/null
+++ b/js/xpconnect/crashtests/1907230.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+window.addEventListener("load", () => {
+  let a = new UIEvent("load", {"bubbles": true})
+  try { document.doctype.dispatchEvent(a) } catch (e) {}
+  document.write("<audio>")
+})
+</script>
diff --git a/js/xpconnect/crashtests/crashtests.list b/js/xpconnect/crashtests/crashtests.list
index 129c34db277..6cf1bf4e435 100644
--- a/js/xpconnect/crashtests/crashtests.list
+++ b/js/xpconnect/crashtests/crashtests.list
@@ -53,3 +53,4 @@ pref(dom.use_xbl_scopes_for_remote_xul,true) load 898939.html
 pref(security.fileuri.strict_origin_policy,false) load 938297.html
 load 977538.html
 load 1577573.html
+load 1907230.html
Loading diff…
On This Page