Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in DevTools
DescriptionUse after free in DevTools
ComponentDevTools
Bug ClassUAF
Tracker384844003
Fix commitbc43bccd60f6 (chromium/src) +5/-4
CISA KEVNot listed
CreditedSakana.S
Disclosed2025-01-28

Changed Functions

FunctionChangeNotes
CORE_EXPORT
third_party/blink/renderer/core/inspector/devtools_agent.h
modified
Client
third_party/blink/renderer/core/inspector/devtools_agent.h
modified

Files Changed

  • third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h
  • third_party/blink/renderer/core/inspector/devtools_agent.cc
  • third_party/blink/renderer/core/inspector/devtools_agent.h
  • third_party/blink/renderer/core/inspector/worker_inspector_controller.h
From bc43bccd60f6d79d329ed70231547d75ac57bd4b Mon Sep 17 00:00:00 2001
From: Andrey Kosyakov <[email protected]>
Date: Wed, 15 Jan 2025 10:17:13 -0800
Subject: [PATCH] Make DevToolsAgent::Client a GCMixin, since the implementation is GCed

We used to keep a raw pointer to Client in DevToolsAgent, which does
not play well when the implementation is getting collected.

Bug: 384844003
Change-Id: Id34886635955133f0be746a9e6e910f9e6891dbf
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6175790
Commit-Queue: Andrey Kosyakov <[email protected]>
Reviewed-by: Daniel Cheng <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1406819}
---

diff --git a/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h b/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h
index 73d5b643..e7c60ea 100644
--- a/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h
+++ b/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h
@@ -66,7 +66,7 @@
 
   WebDevToolsAgentImpl(WebLocalFrameImpl*);
   ~WebDevToolsAgentImpl() override;
-  virtual void Trace(Visitor*) const;
+  void Trace(Visitor*) const override;
   DevToolsAgent* GetDevToolsAgent() const { return agent_.Get(); }
 
   void WillBeDestroyed();
diff --git a/third_party/blink/renderer/core/inspector/devtools_agent.cc b/third_party/blink/renderer/core/inspector/devtools_agent.cc
index 27aa9471..c57c5fc 100644
--- a/third_party/blink/renderer/core/inspector/devtools_agent.cc
+++ b/third_party/blink/renderer/core/inspector/devtools_agent.cc
@@ -189,6 +189,7 @@
 DevToolsAgent::~DevToolsAgent() = default;
 
 void DevToolsAgent::Trace(Visitor* visitor) const {
+  visitor->Trace(client_);
   visitor->Trace(associated_receiver_);
   visitor->Trace(host_remote_);
   visitor->Trace(associated_host_remote_);
diff --git a/third_party/blink/renderer/core/inspector/devtools_agent.h b/third_party/blink/renderer/core/inspector/devtools_agent.h
index f44494a..acf99dd 100644
--- a/third_party/blink/renderer/core/inspector/devtools_agent.h
+++ b/third_party/blink/renderer/core/inspector/devtools_agent.h
@@ -40,7 +40,7 @@
 class CORE_EXPORT DevToolsAgent : public GarbageCollected<DevToolsAgent>,
                                   public mojom::blink::DevToolsAgent {
  public:
-  class Client {
+  class Client : public GarbageCollectedMixin {
    public:
     virtual ~Client() = default;
     virtual void AttachSession(DevToolsSession*, bool restore) = 0;
@@ -139,7 +139,7 @@
   void ReportChildTargetsImpl(bool report,
                               bool wait_for_debugger,
                               base::OnceClosure callback);
-  Client* client_;
+  Member<Client> const client_;
   // DevToolsAgent is not tied to ExecutionContext
   HeapMojoAssociatedReceiver<mojom::blink::DevToolsAgent, DevToolsAgent>
       associated_receiver_{this, nullptr};
diff --git a/third_party/blink/renderer/core/inspector/worker_inspector_controller.h b/third_party/blink/renderer/core/inspector/worker_inspector_controller.h
index 400ad43..50c7d78 100644
--- a/third_party/blink/renderer/core/inspector/worker_inspector_controller.h
+++ b/third_party/blink/renderer/core/inspector/worker_inspector_controller.h
@@ -72,7 +72,7 @@
   WorkerInspectorController& operator=(const WorkerInspectorController&) =
       delete;
   ~WorkerInspectorController() override;
-  void Trace(Visitor*) const;
+  void Trace(Visitor*) const override;
 
   CoreProbeSink* GetProbeSink() const { return probe_sink_.Get(); }
   DevToolsAgent* GetDevToolsAgent() const { return agent_.Get(); }
Loading diff…

Original Bug Report

reported by [email protected]

use-after-poison in blink::DevToolsSession::DispatchProtocolCommandImpl

VULNERABILITY DETAILS UAP in blink::DevToolsSession::DispatchProtocolCommandImpl

VERSION Chrome Version: 133.0.6889.0(Developer Build) Operating System: Ubuntu 24.04

REPRODUCTION CASE

  1. put manifest.json/background.js into the extension_path
  2. run the command: ./chrome –user-data-dir=./noexist –no-sandbox –load-extension=“extension_path”

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: renderer Crash State: see asan.log file

CREDIT INFORMATION Externally reported security bugs may appear in Chrome release notes. If this bug is included, how would you like to be credited? Reporter credit: Sakana.S

View on issue tracker