Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A logic error in Dawn’s Vulkan backend allows uninitialized GPU process heap memory to be persisted to the on-disk shader cache when a specific driver workaround is triggered. This occurs because the code fails to clear a previously allocated buffer after an incomplete serialization attempt. The persisted data is later reloaded and passed to the Vulkan driver, potentially leading to memory corruption.

Affected files:

• third_party/dawn/src/dawn/native/vulkan/PipelineCacheVk.cpp
• third_party/dawn/src/dawn/native/PipelineCache.cpp
• third_party/dawn/src/dawn/native/Blob.cpp

Estimated timestamp from git blame: Unknown (Google3 checkout)

Description

A potential logic error exists in PipelineCache::SerializeToBlobImpl within Dawn’s Vulkan backend that can cause uninitialized heap memory to be persisted to the persistent blob cache. This occurs when the VulkanIncompletePipelineCacheWorkaround is triggered on specific hardware (e.g., Pixel 10, Samsung Xclipse).

Root Cause Analysis

In third_party/dawn/src/dawn/native/vulkan/PipelineCacheVk.cpp, the function SerializeToBlobImpl handles the serialization of the Vulkan pipeline cache:

1. At line 95, a blob is allocated to hold the cache data: *blob = Blob::Create(bufferSize);.
2. Blob::Create in third_party/dawn/src/dawn/native/Blob.cpp (line 46) allocates memory via new uint8_t[size], which leaves the buffer uninitialized, containing residual data from the GPU process heap.
3. vkGetPipelineCacheData is called to fill this buffer (line 96).
4. If the call returns VK_INCOMPLETE and the workaround is enabled (line 99), the code sets mSkipSerialize = true and returns success (return {};) at line 105.

However, the function fails to clear or reset the *blob out-parameter before returning. The caller, PipelineCacheBase::Flush() in third_party/dawn/src/dawn/native/PipelineCache.cpp, subsequently checks if (blob.Size() > 0) at line 62. Since the blob was assigned an uninitialized buffer of bufferSize, this condition is true, and the uninitialized memory is stored to the persistent cache via mCache->Store(mKey, blob); (line 65).

Potential Impact

1. Information Leak: Sensitive residue from the GPU process heap is written to the persistent shader cache on disk.
2. Memory Corruption: On subsequent sessions, the persisted uninitialized blob is reloaded and passed as pInitialData to vkCreatePipelineCache (line 130 of PipelineCacheVk.cpp). If the driver’s binary parser is not robust against malformed or uninitialized input, this could lead to memory corruption within the GPU process.
3. Sandbox Escape (Android): On Android, the GPU process is typically unsandboxed by default. Memory corruption in this process could allow an attacker to achieve arbitrary code execution with the user’s full privileges.

Potential Reproduction Steps (Suggested)

Note: These steps are theoretical as they rely on specific hardware behavior and have not been validated by a running exploit.

1. Use an affected Android device (e.g., Pixel 10 or Samsung Xclipse) with WebGPU enabled.
2. From a web page, trigger the compilation of a new shader (e.g., via createComputePipeline).
3. The Vulkan driver returns VK_INCOMPLETE during cache serialization.
4. Dawn’s workaround triggers but fails to clear the blob out-parameter.
5. The uninitialized heap memory is written to the on-disk cache.
6. Restart the browser and re-trigger the same pipeline creation. The corrupted cache is loaded and passed to the driver’s vkCreatePipelineCache, potentially causing corruption.

Suggested Fix

Ensure the *blob out-parameter is cleared before returning in the VK_INCOMPLETE workaround path in third_party/dawn/src/dawn/native/vulkan/PipelineCacheVk.cpp:

if (result == VK_INCOMPLETE && mInvalidResultWorkaround) {
    mSkipSerialize = true;
    *blob = Blob(); // Clear the out-parameter to prevent storage
    return {};
}

Evaluated with Chrome root at commit: b3153093eb3c78c3e88ccf562bcbc20437a04b0e

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.