Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the security team.

Overview: A potential vulnerability exists where native YUV textures bypass validation due to a missing isYUV() override in gl::Texture. A compromised renderer can pass an arbitrary YUV format to the passthrough decoder, causing ANGLE to send malformed multi-planar commands to the Vulkan backend. This results in undefined driver behavior and potential GPU process memory corruption.

Affected files:

• third_party/angle/src/libANGLE/Texture.h
• third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.h
• third_party/angle/src/libANGLE/Texture.cpp
• third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.cpp
• third_party/angle/src/libANGLE/Image.cpp
• third_party/angle/src/libANGLE/validationES.cpp
• third_party/angle/src/libANGLE/Framebuffer.cpp

Estimated timestamp from git blame: 2023-10-17

Description

A potential vulnerability exists in how ANGLE handles native YUV textures (e.g., GL_G8_B8R8_2PLANE_420_UNORM_ANGLE), allowing a compromised renderer to bypass validation and trigger undefined behavior in the GPU process via Vulkan API violations. This relies on three chained flaws in the GPU process:

1. Passthrough Decoder Validation Bypass: The GLES2DecoderPassthroughImpl blindly forwards the internalformat argument of commands like TexStorage2DEXT directly to ANGLE without validating it against Chrome’s validators_.texture_internal_format_storage. A compromised renderer can manually construct an IPC to submit arbitrary internal formats.
2. Missing gl::Texture::isYUV() Override: gl::Texture inherits from egl::ImageSibling but does not override the virtual isYUV() method. The default egl::ImageSibling::isYUV() implementation returns false unless the texture is an EGLImage target (mTargetOf). Native YUV textures created via glTexStorage2DEXT have a null mTargetOf, causing isYUV() to incorrectly return false. This causes ANGLE validation functions (e.g., ValidateCopyTexImageParametersBase) to treat the texture as a standard color format and bypass GL_INVALID_OPERATION errors for YUV-restricted operations.
3. Vulkan Backend Format Misidentification: In the Vulkan backend (e.g., ImageHelper::readPixelsImpl), ANGLE checks if a texture requires YUV-to-RGBA staging by evaluating getExternalFormat() != 0. Because native Vulkan YUV formats have an external format of 0, this check fails, and the safe staging path is skipped.

When these flaws are combined, ANGLE attempts direct operations (e.g., vkCmdCopyImageToBuffer) on the multi-planar YUV image using VK_IMAGE_ASPECT_COLOR_BIT. This violates Vulkan specification requirements (VUID-vkCmdCopyImageToBuffer-srcImage-07971), resulting in undefined behavior and out-of-bounds memory accesses in the underlying graphics driver.

Potential Reproduction Steps

Note: Our tooling agent does not have the ability to run code. These are the suggested steps an attacker would follow.

1. Obtain arbitrary code execution within a sandboxed renderer process.
2. Write a raw glRequestExtensionCHROMIUM IPC to the command buffer to enable the GL_ANGLE_yuv_internal_format extension for the context.
3. Construct a raw TexStorage2DEXT IPC, manually setting the internalformat argument to GL_G8_B8R8_2PLANE_420_UNORM_ANGLE (enum value 0x96B1).
4. Create a Framebuffer Object (FBO) and bind the native YUV texture to color attachment 0. ANGLE will report the framebuffer as GL_FRAMEBUFFER_COMPLETE.
5. Trigger a command strictly prohibited for YUV framebuffers, such as glCopyTexImage2D or glReadPixels.
6. Because validation is bypassed, the invalid operation reaches the Vulkan backend, passing a malformed command to the driver and triggering a potential sandbox escape.

Suggested Fix

1. Override isYUV() in gl::Texture: Implement gl::Texture::isYUV() to accurately report its state based on its internal format (e.g., checking if the base level description format has the YUV property).
2. Update Vulkan Backend Checks: Update the backend (e.g., ImageHelper::readPixelsImpl) to rely on the actual format’s YUV property (getActualFormat().isYUV) instead of strictly checking if the external format is non-zero.
3. Harden Passthrough Decoder: Implement validation in GLES2DecoderPassthroughImpl::DoTexStorage2DEXT and related commands to reject internalformat values that are not explicitly permitted by Chrome’s feature info.

Evaluated with Chrome root at commit: f200f57a19490707ff8bc7aa5de3cbc443a3afad

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.