Chrome · DevTools
CVE-2025-0762
UAF in DevTools
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
CORE_EXPORTthird_party/blink/renderer/core/inspector/devtools_agent.h |
modified | |
Clientthird_party/blink/renderer/core/inspector/devtools_agent.h |
modified |
Files Changed
third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.hthird_party/blink/renderer/core/inspector/devtools_agent.ccthird_party/blink/renderer/core/inspector/devtools_agent.hthird_party/blink/renderer/core/inspector/worker_inspector_controller.h
Patch
From bc43bccd60f6d79d329ed70231547d75ac57bd4b Mon Sep 17 00:00:00 2001 From: Andrey Kosyakov <[email protected]> Date: Wed, 15 Jan 2025 10:17:13 -0800 Subject: [PATCH] Make DevToolsAgent::Client a GCMixin, since the implementation is GCed We used to keep a raw pointer to Client in DevToolsAgent, which does not play well when the implementation is getting collected. Bug: 384844003 Change-Id: Id34886635955133f0be746a9e6e910f9e6891dbf Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6175790 Commit-Queue: Andrey Kosyakov <[email protected]> Reviewed-by: Daniel Cheng <[email protected]> Cr-Commit-Position: refs/heads/main@{#1406819} --- diff --git a/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h b/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h index 73d5b643..e7c60ea 100644 --- a/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h +++ b/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h @@ -66,7 +66,7 @@ WebDevToolsAgentImpl(WebLocalFrameImpl*); ~WebDevToolsAgentImpl() override; - virtual void Trace(Visitor*) const; + void Trace(Visitor*) const override; DevToolsAgent* GetDevToolsAgent() const { return agent_.Get(); } void WillBeDestroyed(); diff --git a/third_party/blink/renderer/core/inspector/devtools_agent.cc b/third_party/blink/renderer/core/inspector/devtools_agent.cc index 27aa9471..c57c5fc 100644 --- a/third_party/blink/renderer/core/inspector/devtools_agent.cc +++ b/third_party/blink/renderer/core/inspector/devtools_agent.cc @@ -189,6 +189,7 @@ DevToolsAgent::~DevToolsAgent() = default; void DevToolsAgent::Trace(Visitor* visitor) const { + visitor->Trace(client_); visitor->Trace(associated_receiver_); visitor->Trace(host_remote_); visitor->Trace(associated_host_remote_); diff --git a/third_party/blink/renderer/core/inspector/devtools_agent.h b/third_party/blink/renderer/core/inspector/devtools_agent.h index f44494a..acf99dd 100644 --- a/third_party/blink/renderer/core/inspector/devtools_agent.h +++ b/third_party/blink/renderer/core/inspector/devtools_agent.h @@ -40,7 +40,7 @@ class CORE_EXPORT DevToolsAgent : public GarbageCollected<DevToolsAgent>, public mojom::blink::DevToolsAgent { public: - class Client { + class Client : public GarbageCollectedMixin { public: virtual ~Client() = default; virtual void AttachSession(DevToolsSession*, bool restore) = 0; @@ -139,7 +139,7 @@ void ReportChildTargetsImpl(bool report, bool wait_for_debugger, base::OnceClosure callback); - Client* client_; + Member<Client> const client_; // DevToolsAgent is not tied to ExecutionContext HeapMojoAssociatedReceiver<mojom::blink::DevToolsAgent, DevToolsAgent> associated_receiver_{this, nullptr}; diff --git a/third_party/blink/renderer/core/inspector/worker_inspector_controller.h b/third_party/blink/renderer/core/inspector/worker_inspector_controller.h index 400ad43..50c7d78 100644 --- a/third_party/blink/renderer/core/inspector/worker_inspector_controller.h +++ b/third_party/blink/renderer/core/inspector/worker_inspector_controller.h @@ -72,7 +72,7 @@ WorkerInspectorController& operator=(const WorkerInspectorController&) = delete; ~WorkerInspectorController() override; - void Trace(Visitor*) const; + void Trace(Visitor*) const override; CoreProbeSink* GetProbeSink() const { return probe_sink_.Get(); } DevToolsAgent* GetDevToolsAgent() const { return agent_.Get(); }
Loading diff…
Original Bug Report
reported by [email protected]
use-after-poison in blink::DevToolsSession::DispatchProtocolCommandImpl
VULNERABILITY DETAILS UAP in blink::DevToolsSession::DispatchProtocolCommandImpl
VERSION Chrome Version: 133.0.6889.0(Developer Build) Operating System: Ubuntu 24.04
REPRODUCTION CASE
- put manifest.json/background.js into the extension_path
- run the command: ./chrome –user-data-dir=./noexist –no-sandbox –load-extension=“extension_path”
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: renderer Crash State: see asan.log file
CREDIT INFORMATION Externally reported security bugs may appear in Chrome release notes. If this bug is included, how would you like to be credited? Reporter credit: Sakana.S
References
On This Page