Project Fortify, an experimental security project, has identified the following potential security issue.

Overview: The GPU process fails to validate Vulkan YCbCr conversion parameters received from the renderer via IPC. A compromised renderer can send out-of-bounds enum values that are passed directly to the Vulkan driver via Dawn or Skia. This can potentially trigger out-of-bounds memory access within the driver, leading to a GPU sandbox escape.

Affected files:

• gpu/ipc/common/vulkan_ycbcr_info_mojom_traits.h
• gpu/command_buffer/service/shared_image/shared_image_format_service_utils.cc
• components/viz/service/display_embedder/skia_output_surface_impl.cc

Estimated timestamp from git blame: 2019-08-13

Description

There is a potential sandbox escape vulnerability where a compromised Renderer process can send out-of-bounds Vulkan enum values to the GPU process via IPC. When these values are passed to the underlying Vulkan driver, they can cause undefined behavior (such as out-of-bounds array indexing), potentially allowing the attacker to execute arbitrary code within the highly privileged GPU process.

Root Cause

The gpu.mojom.VulkanYCbCrInfo Mojo struct defines Vulkan enum parameters (like suggested_ycbcr_model and suggested_ycbcr_range) as opaque uint32 and uint64 fields instead of strongly-typed Mojo enums. Consequently, Mojo’s automatic enum validation is bypassed.

During deserialization in the GPU process, StructTraits<gpu::mojom::VulkanYCbCrInfoDataView, gpu::VulkanYCbCrInfo>::Read (gpu/ipc/common/vulkan_ycbcr_info_mojom_traits.h) unconditionally copies these raw integer values into the C++ gpu::VulkanYCbCrInfo struct without any bounds checking.

Vulnerable Code Path

1. A compromised renderer embeds a malicious gpu::VulkanYCbCrInfo inside a viz::TransferableResource and sends it to the Viz service in the GPU process.
2. In Viz, when compositing on Android with the Graphite/Dawn backend, SkiaOutputSurfaceImpl::MakePromiseSkImageSinglePlane is called to sample the texture.
3. The unvalidated ycbcr_info is passed to gpu::GraphitePromiseTextureInfo, which calls ToDawnYCbCrVkDescriptor (gpu/command_buffer/service/shared_image/shared_image_format_service_utils.cc).
4. The raw uint32_t values are copied directly into a wgpu::YCbCrVkDescriptor.
5. Dawn processes this descriptor in dawn::native::vulkan::CreateSamplerYCbCrConversionCreateInfo (third_party/dawn/src/dawn/native/vulkan/UtilsVulkan.cpp). It blindly static_casts the out-of-bounds integers to Vulkan enums (e.g., VkSamplerYcbcrModelConversion) and passes them to the vkCreateSamplerYcbcrConversion Vulkan API call.
6. Note: The Ganesh path is similarly vulnerable via gpu::CreateVulkanYcbcrConversionInfo in gpu/command_buffer/service/skia_utils.cc.

Production Vulkan drivers typically lack robust bounds checking for API enums due to performance reasons. Passing invalid enums is known to cause drivers to perform out-of-bounds array reads or writes when looking up internal formats or conversion matrices.

Potential Attacker Steps

Note: These are potential steps to trigger the vulnerability, as this AI agent does not currently have the capability to execute code or build a working Proof of Concept.

1. Achieve arbitrary code execution within the Renderer process sandbox.
2. Craft a malicious viz::CompositorFrame containing a viz::TransferableResource.
3. Populate the ycbcr_info metadata field of the TransferableResource.
4. Set the underlying uint32_t fields (e.g., suggested_ycbcr_model, suggested_ycbcr_range, suggested_xchroma_offset, suggested_ychroma_offset) to extremely large values (e.g., 0xFFFFFFFF) that do not correspond to valid Vulkan enums.
5. Submit the CompositorFrame to the Viz compositor in the GPU process via the standard Mojo IPC channel.
6. The GPU process will deserialize the frame, pass the malicious enums to the Vulkan driver, and trigger an out-of-bounds memory access, which the attacker can shape to achieve remote code execution in the GPU process.

Suggested Fix

Implement strict validation for all fields in gpu::VulkanYCbCrInfo when they cross the IPC boundary.

Modify StructTraits<gpu::mojom::VulkanYCbCrInfoDataView, gpu::VulkanYCbCrInfo>::Read in gpu/ipc/common/vulkan_ycbcr_info_mojom_traits.h to verify that each uint32_t value corresponds to a valid and supported Vulkan enum constant (e.g., checking against the maximum valid enum values for VkSamplerYcbcrModelConversion, VkSamplerYcbcrRange, etc.). If any value is out of bounds, the Read function should return false to reject the IPC message and terminate the misbehaving renderer.

Evaluated with Chrome root at commit: 0eb4855bda702feaaa8b899336664f97e3df88b8

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. Please feel free to reach out to me if you have concerns or feedback.