Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A potential Use-After-Free (UAF) vulnerability exists in CastMessagePortImpl::MaybeClose in the browser process. Calling client_->OnError can trigger a synchronous destruction cascade that deletes the CastMessagePortImpl instance. The code subsequently continues to execute and evaluate the on_close_ callback from the freed memory of the deleted instance.

Affected files:

• components/cast_streaming/browser/cast_message_port_impl.cc
• components/cast_streaming/browser/cast_message_port_impl.h

Estimated timestamp from git blame: 2020-12-04

Description

A potential Use-After-Free (UAF) vulnerability has been identified in CastMessagePortImpl::MaybeClose() within components/cast_streaming/browser/cast_message_port_impl.cc. Under specific conditions, invoking the error callback on client_ initiates a synchronous teardown sequence on the same call stack. This sequence results in the deletion of the CastMessagePortImpl instance. When the execution unwinds back to the caller frame, the method attempts to read and execute the in-object on_close_ closure member variable on the already-freed this pointer.

Because on_close_ is a base::OnceClosure (which wraps a reference-counted BindStateBase pointer) rather than a raw_ptr, MiraclePtr (BackupRefPtr) does not protect against or mitigate this memory safety violation.

Potential Step-by-Step Sequence

(Note: These are potential steps identified through static code analysis; we do not currently have a running proof-of-concept exploit.)

1. During the initial connection handshake phase when is_initialized_ is still false, a connection error or channel closure is encountered on the MessagePort channel (for example, if a compromised Renderer process abruptly closes the Mojo IPC pipe of the MessagePort).
2. This triggers CastMessagePortImpl::OnPipeError(), which synchronously calls CastMessagePortImpl::MaybeClose().
3. Inside MaybeClose(), client_->OnError() is called on line 104 with kCastV2CastSocketError.
4. client_ (a ReceiverSessionMessenger instance) synchronously executes ReportError(), propagating the error to the registered Open Screen callback lambda, which synchronously calls ReceiverSessionClient::OnError().
5. Because initialization is not yet complete (is_initialized_ == false), OnError() synchronously calls EndSession(), which triggers a sequence of termination events:
   • ReceiverSessionImpl::OnSessionEnded()
   • StreamingReceiverSessionClient::OnStreamingSessionEnded()
   • StreamingRuntimeApplication::OnError()
   • StreamingRuntimeApplication::StopApplication()
6. Inside StopApplication(), receiver_session_client_.reset() is called. This triggers a synchronous destruction cascade of all owned components, including StreamingReceiverSessionClient, ReceiverSessionImpl, CastStreamingSession, and eventually CastMessagePortImpl (this is deallocated).
7. The execution flow unwinds back to CastMessagePortImpl::MaybeClose() (line 107) and evaluates if (on_close_). Since this has been deleted, it performs a Use-After-Free read and subsequently calls std::move(on_close_).Run() on line 110, allowing a potential instruction pointer hijack in the unsandboxed Browser process.

Proposed Remediation

To prevent this vulnerability, use a base::WeakPtr to check for the instance’s liveness before accessing any member variables or running callbacks after client_->OnError() is called.

Add a base::WeakPtrFactory<CastMessagePortImpl> weak_factory_{this}; to CastMessagePortImpl and update MaybeClose to:

void CastMessagePortImpl::MaybeClose() {
  base::WeakPtr<CastMessagePortImpl> weak_this = weak_factory_.GetWeakPtr();
  if (message_port_) {
    message_port_.reset();
  }
  if (client_) {
    client_->OnError(
        openscreen::Error(openscreen::Error::Code::kCastV2CastSocketError));
  }
  if (weak_this && weak_this->on_close_) {
    std::move(weak_this->on_close_).Run();
  }
}

Evaluated with Chrome root at commit: b1520ef4a76878853a31f0943b565e42060edec8

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.