Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: An atomicity violation in ANGLE’s State::syncDirtyObjects can desynchronize dirty texture sub-masks if a handler returns an early Stop without losing context. Combined with missing active texture cache invalidation during program relinking, this potentially enables a Use-After-Free condition in the GPU process.

Affected files:

• third_party/angle/src/libANGLE/State.h
• third_party/angle/src/libANGLE/State.cpp
• third_party/angle/src/libANGLE/Context.cpp
• third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp

Estimated timestamp from git blame: 2023-09-06

1. Summary of the Issue (Meant for Human Triage)

An atomicity break exists within the ANGLE front-end state synchronization mechanism (State::syncDirtyObjects). During state synchronization, ANGLE sequentially executes dirty object handlers. If an early handler (e.g., DIRTY_OBJECT_ACTIVE_TEXTURES) successfully clears its fine-grained sub-mask, but a subsequent handler (e.g., DIRTY_OBJECT_DRAW_FRAMEBUFFER) hits a non-fatal backend validation error and returns an early angle::Result::Stop, the loop terminates. This abort prevents the clearing of the coarse mDirtyObjects bitset and later sub-masks like mDirtyTextures, leading to a state desynchronization where mDirtyTextures indicates a texture needs synchronization, but mDirtyActiveTextures does not.

An attacker can exploit this desynchronization in conjunction with a logic flaw in glLinkProgram. When a program is re-linked, State::installProgramExecutable replaces the current executable without calling unsetActiveTextures for the old executable’s samplers mask (unlike the standard State::setProgram swap path). By manipulating the active program so that it no longer samples a specific texture unit, the attacker can cause the active textures cache (mActiveTexturesCache) to hold a dangling raw pointer to a deleted Texture object. A subsequent draw call processes the stale mDirtyTextures bit and dereferences this dangling pointer, leading to a potential Use-After-Free (UAF) read and virtual function call in the GPU process.

This vulnerability is reachable by a compromised renderer via forged command-buffer IPCs. Because the GPU process is unsandboxed on Android, this memory corruption potentially allows for arbitrary code execution with the user’s full privileges on that platform.

2. Proof-of-Concept & Detailed Execution Flow

Root Cause Analysis

In third_party/angle/src/libANGLE/State.h, State::syncDirtyObjects synchronizes dirty objects in an enumerated order:

ANGLE_INLINE angle::Result State::syncDirtyObjects(const Context *context,
                                                   const state::DirtyObjects &bitset,
                                                   Command command)
{
    mDirtyObjects |= mPrivateState.getDirtyObjects();
    mPrivateState.clearDirtyObjects();
    ...
    const state::DirtyObjects &dirtyObjects = mDirtyObjects & bitset;
    for (size_t dirtyObject : dirtyObjects)
    {
        ANGLE_TRY(dirtyObjectHandler(dirtyObject, context, command));   // Line 1755: Early return on Stop
    }
    mDirtyObjects &= ~dirtyObjects;                                     // Line 1758: Skipped on Stop
    return angle::Result::Continue;
}

The handlers execute in DirtyObjectType enum order. DIRTY_OBJECT_ACTIVE_TEXTURES (handler 0) runs first, updating mActiveTexturesCache and explicitly calling mDirtyActiveTextures.reset() (State.cpp:3842). If a subsequent handler, such as DIRTY_OBJECT_DRAW_FRAMEBUFFER (handler 6), returns an early Stop, the loop exits. mDirtyObjects and mDirtyTextures retain their bits, while mDirtyActiveTextures remains empty.

Non-Context-Losing Validation Error

Certain backend errors are non-fatal and do not mark the context as lost. On the Vulkan backend, attaching a multisampled framebuffer with an unsupported color format triggers a non-fatal VK_ERROR_FORMAT_NOT_SUPPORTED (TextureVk.cpp:4346):

if (ANGLE_UNLIKELY(mState.hasBeenBoundToMSRTTFramebuffer() && !supportsMSRTTUsage))
{
    ERR() << "Texture bound to EXT_multisampled_render_to_texture framebuffer, ...";
    ANGLE_VK_TRY(contextVk, VK_ERROR_FORMAT_NOT_SUPPORTED);
}

This error is mapped to GL_INVALID_OPERATION by DefaultGLErrorCode (ContextVk.cpp:94). ErrorSet::handleError (Context.cpp:10292) only marks the context as lost for GL_OUT_OF_MEMORY. Thus, the context remains alive and can continue accepting commands despite the Stop returned to syncDirtyObjects.

The Cache Invalid Bypass via Relinking

If the attacker re-links the active program instead of changing it, Context::onSubjectStateChange (Context.cpp:9501) invokes State::installProgramExecutable. Unlike State::setProgram, this function does not clear the old executable’s texture mask:

angle::Result State::installProgramExecutable(const Context *context)
{
    ... // Replaces executable without calling unsetActiveTextures(mExecutable->getActiveSamplersMask())
    InstallExecutable(context, mProgram->getSharedExecutable(), &mExecutable);
    return onExecutableChange(context);
}

onExecutableChange (State.cpp:4083) iterates strictly over the new executable’s getActiveSamplersMask(). If a unit is removed in the new shader, mActiveTexturesCache keeps the old raw Texture*.

Potential Exploitation Sequence

(Note: Our tooling agent does not have the ability to run code; these are hypothesized execution steps based on the code analysis.)

1. Setup Program: glUseProgram(P1) where P1 actively samples from texture unit i of type T.
2. Setup Texture: glActiveTexture(GL_TEXTURE0 + i); glBindTexture(T, texA). Mutate parameters (e.g., glTexParameteri) so mDirtyActiveTextures[i] = 1 and mDirtyTextures[i] = 1.
3. Setup Failing FBO: Bind a draw framebuffer designed to trigger the Vulkan VK_ERROR_FORMAT_NOT_SUPPORTED error (e.g., using glFramebufferTexture2DMultisampleEXT with a format incompatible with multisampled rendering).
4. Trigger Desync: Call glDrawArrays().
   • syncActiveTextures (handler 0) runs, caching texA in mActiveTexturesCache[i] and resetting mDirtyActiveTextures.
   • syncDrawFramebuffer (handler 6) encounters the format error and aborts the loop with a non-context-losing Stop.
   • mDirtyTextures[i] remains 1.
5. Relink to Bypass Cache Update: Bind a valid FBO. Modify P1’s shader source to stop sampling unit i. Issue glLinkProgram(P1). installProgramExecutable replaces the executable but fails to reset mActiveTexturesCache[i], which still points to texA.
6. Create Dangling Pointer: Bind a new texture texB to unit i. In State::setSamplerTexture (State.cpp:2731), updateTextureBinding is skipped because !mExecutable->getActiveSamplersMask()[getActiveSampler()]. However, mSamplerTextures is still updated (State.cpp:2738), dropping the strong reference to texA. Delete texA via glDeleteTextures(). State::detachTexture fails to find texA in mSamplerTextures, destroying texA while leaving mActiveTexturesCache[i] as a raw dangling pointer.
7. Trigger UAF: Issue a second glDrawArrays().
   • Handler 0 skips because mDirtyActiveTextures is clear.
   • Handler 8 (syncTextures) iterates over the stale mDirtyTextures[i] bit.
   • It fetches the dangling pointer texture = mActiveTexturesCache[i].
   • It executes the UAF read texture->hasAnyDirtyBit() and potentially texture->syncState(), resulting in a virtual method call (mTexture->syncState) hijacked by the attacker’s heap data.

Suggested Fix

Ensure that State::installProgramExecutable and State::installProgramPipelineExecutable correctly invoke unsetActiveTextures for the existing mExecutable->getActiveSamplersMask() prior to installing the new executable, mirroring the safety guarantees in State::setProgram. Additionally, the atomicity logic within State::syncDirtyObjects should be evaluated so early returns rollback or re-evaluate sub-masks (like mDirtyActiveTextures) if the entire state synchronization fails to complete.

3. Technical Verification Details (Automated Audit Logs - Reviewers may skip this section)

> “The primary §G3.9 GPU-STATE desync and non-OOM Stop path are valid. The rewriter correctly noted that glUseProgram(P2) calls unsetActiveTextures, which resets mActiveTexturesCache[i] and defeats the provided UAF chain. However, the exact same cache-not-reset primitive can be achieved by mutating and re-linking the currently active program (glLinkProgram(P1)) instead of swapping programs. When P1 is relinked, Context::onSubjectStateChange calls mState.installProgramExecutable(this). This replaces mExecutable and calls onExecutableChange(context), which iterates only over the new executable’s mask. Crucially, unlike State::setProgram, installProgramExecutable does not call unsetActiveTextures for the old mask. If the relinked program no longer samples unit i, updateTextureBinding is skipped, and mActiveTexturesCache[i] remains pointing to texA. > > From here, the rest of the chain holds: glBindTexture(texB) skips updateTextureBinding (because activeSamplersMask()[i] is false) but overwrites mSamplerTextures; glDeleteTextures(texA) fails to find texA in mSamplerTextures, leaving mActiveTexturesCache[i] dangling. The next glDrawArrays processes the orphaned mDirtyTextures[i] bit, leading to a UAF read and virtual call (texture->syncState()). > > Because mActiveTexturesCache holds raw Texture* (no MiraclePtr protection in ANGLE third_party), and this provides a GPU-process UAF reachable via forged command-buffer IPC from a compromised renderer (unsandboxed on Android), this is a High (S1) severity vulnerability.”

Ledger of Verified Traces:

1. State::syncDirtyObjects Atomicity Break: third_party/angle/src/libANGLE/State.h:1739-1762. The ANGLE_TRY at line 1755 early-aborts the loop on angle::Result::Stop, bypassing mDirtyObjects &= ~dirtyObjects at line 1758. Handler 0 clears its mask at State.cpp:3842 (mDirtyActiveTextures.reset()) independently of subsequent handlers.
2. Vulkan Non-Fatal Backend Validation Error: third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp:4342-4346. ANGLE_VK_TRY(contextVk, VK_ERROR_FORMAT_NOT_SUPPORTED) propagates up through vk_utils.h:1775-1784’s ANGLE_VK_TRY macro. DefaultGLErrorCode (ContextVk.cpp:83-96) maps this to GL_INVALID_OPERATION. ErrorSet::handleError (Context.cpp:10286-10310) does not mark the context as lost because it checks strictly for GL_OUT_OF_MEMORY combined with GL_LOSE_CONTEXT_ON_RESET_EXT.
3. State::installProgramExecutable Missing Invalidation: third_party/angle/src/libANGLE/State.cpp:4029-4048. The executable is explicitly updated via InstallExecutable without calling unsetActiveTextures for the prior mask. In contrast, State::setProgram does this safely at State.cpp:3085.
4. State::onExecutableChange State Update Flaw: third_party/angle/src/libANGLE/State.cpp:4078-4115. Iterates strictly over the incoming executable’s mask: for (size_t textureIndex : mExecutable->getActiveSamplersMask()). Bypasses deactivated units.
5. State::setSamplerTexture Bypass: third_party/angle/src/libANGLE/State.cpp:2729-2741. Checks mExecutable->getActiveSamplersMask()[getActiveSampler()]. If false, updateTextureBinding is skipped. The array mSamplerTextures[type][getActiveSampler()] is still overwritten with .set(context, texture), removing the previous strong reference.
6. Raw Pointer Danger: third_party/angle/src/libANGLE/State.h:79 declares ActiveTextureArray<Texture *> mTextures;. ANGLE represents a third-party dependency with raw C++ pointers, omitting MiraclePtr protection against standard memory corruption.

Evaluated with Chrome root at commit: b96d2ec58f4f5f92b540a723966b199d6e9951b4

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.