[1354:1354:0520/232005.511170:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1587] drmGetDevices2() has not found any devices [1354:1354:0520/232005.512892:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [1322:1322:0520/232005.607209:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. LaunchProcess: failed to execvp: xdg-desktop-menu LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource LaunchProcess: failed to execvp: xdg-icon-resource [1322:1334:0520/232006.410908:WARNING:chrome/browser/web_applications/os_integration/web_app_shortcut_linux.cc:186] Could not install icon chrome-iedmbinbpnlgcnbnlhkgpbjeonpkkohk-Default.png at size 512. LaunchProcess: failed to execvp: xdg-desktop-menu [1322:1322:0520/232006.549759:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [1322:1337:0520/232011.781004:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT [1322:1322:0520/232012.776554:INFO:CONSOLE:11] "[POC] caller app: invoking developerPrivate.updateExtensionConfiguration", source: chrome-extension://iedmbinbpnlgcnbnlhkgpbjeonpkkohk/background.js (11) ================================================================= ==1322==ERROR: AddressSanitizer: heap-use-after-free on address 0x736c7aa8f4a8 at pc 0x582bce303a7b bp 0x7fffe82c25b0 sp 0x7fffe82c25a8 READ of size 8 at 0x736c7aa8f4a8 thread T0 (chrome) #0 0x582bce303a7a in extensions::Extension::id() const gen/third_party/libc++/src/include/__memory/unique_ptr.h:265:101 #1 0x582bba9235e7 in extensions::util::CanWithholdPermissionsFromExtension(extensions::Extension const&) extensions/browser/extension_util.cc:300:17 #2 0x582bba9ae5f6 in extensions::PermissionsManager::CanAffectExtension(extensions::Extension const&) const extensions/browser/permissions_manager.cc:538:8 #3 0x582bbe421997 in extensions::api::DeveloperPrivateUpdateExtensionConfigurationFunction::Run() chrome/browser/extensions/api/developer_private/developer_private_functions.cc:656:19 #4 0x582bba8788c2 in ExtensionFunction::RunWithValidation() extensions/browser/extension_function.cc:494:10 #5 0x582bba8895d3 in extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(mojo::StructPtr, content::RenderFrameHost*, content::RenderProcessHost&, base::OnceCallback, std::__Cr::allocator> const&, mojo::StructPtr)>) extensions/browser/extension_function_dispatcher.cc:457:15 #6 0x582bba88783d in extensions::ExtensionFunctionDispatcher::Dispatch(mojo::StructPtr, content::RenderFrameHost&, base::OnceCallback, std::__Cr::allocator> const&, mojo::StructPtr)>) extensions/browser/extension_function_dispatcher.cc:191:3 #7 0x582bba872a3f in extensions::ExtensionFrameHost::Request(mojo::StructPtr, base::OnceCallback, std::__Cr::allocator> const&, mojo::StructPtr)>) extensions/browser/extension_frame_host.cc:65:9 #8 0x582bbab7a6aa in extensions::mojom::LocalFrameHostStubDispatch::AcceptWithResponder(extensions::mojom::LocalFrameHost*, mojo::Message*, std::__Cr::unique_ptr>) gen/extensions/common/mojom/frame.mojom.cc:4249:13 #9 0x582bc48cb637 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #10 0x582bc48e9163 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24 #11 0x582bc48d1943 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #12 0x582bc79e57f3 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24 #13 0x582bc79e7c75 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #14 0x582bc3b11493 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #15 0x582bc3b804bc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #16 0x582bc3b7f35a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #17 0x582bc3d2b7f8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #18 0x582bc3d2edb8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #19 0x760c7dd05718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d) 0x736c7aa8f4a8 is located 552 bytes inside of 616-byte region [0x736c7aa8f280,0x736c7aa8f4e8) freed by thread T0 (chrome) here: #0 0x582bab9811a2 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2f1a2) (BuildId: b74558559e77a25d) #1 0x582bce318808 in void std::__Cr::__destroy_at, std::__Cr::allocator> const, scoped_refptr>>(std::__Cr::pair, std::__Cr::allocator> const, scoped_refptr>*) base/memory/ref_counted.h:438:5 #2 0x582bce31902f in unsigned long std::__Cr::__tree, std::__Cr::allocator>, scoped_refptr>, std::__Cr::__map_value_compare, std::__Cr::allocator>, std::__Cr::pair, std::__Cr::allocator> const, scoped_refptr>, std::__Cr::less, std::__Cr::allocator>>>, std::__Cr::allocator, std::__Cr::allocator> const, scoped_refptr>>>::__erase_unique, std::__Cr::allocator>>(std::__Cr::basic_string, std::__Cr::allocator> const&) gen/third_party/libc++/src/include/__memory/allocator_traits.h:373:5 #3 0x582bce31706e in extensions::ExtensionSet::Remove(std::__Cr::basic_string, std::__Cr::allocator> const&) gen/third_party/libc++/src/include/map:1262:79 #4 0x582bba8f1de3 in extensions::ExtensionRegistrar::ReplaceReloadedExtension(scoped_refptr) extensions/browser/extension_registrar.cc:1252:20 #5 0x582bba8f07df in extensions::ExtensionRegistrar::AddExtension(scoped_refptr) extensions/browser/extension_registrar.cc:202:5 #6 0x582bbe675dfb in extensions::InstalledLoader::Load(extensions::ExtensionInfo const&, bool) chrome/browser/extensions/installed_loader.cc:354:38 #7 0x582bbe593bc8 in extensions::ChromeExtensionRegistrarDelegate::DoLoadExtensionForReload(std::__Cr::basic_string, std::__Cr::allocator> const&, base::FilePath const&, bool) chrome/browser/extensions/chrome_extension_registrar_delegate.cc:279:31 #8 0x582bba8f9d14 in extensions::ExtensionRegistrar::DoReloadExtension(std::__Cr::basic_string, std::__Cr::allocator>, extensions::ExtensionRegistrar::LoadErrorBehavior) extensions/browser/extension_registrar.cc #9 0x582bba8f8bca in extensions::ExtensionRegistrar::ReloadExtension(std::__Cr::basic_string, std::__Cr::allocator> const&) extensions/browser/extension_registrar.cc:632:3 #10 0x582bbe64059b in extensions::util::SetAllowFileAccess(std::__Cr::basic_string, std::__Cr::allocator> const&, content::BrowserContext*, bool) chrome/browser/extensions/extension_util.cc:68:37 #11 0x582bbe4218bf in extensions::api::DeveloperPrivateUpdateExtensionConfigurationFunction::Run() chrome/browser/extensions/api/developer_private/developer_private_functions.cc:636:5 #12 0x582bba8788c2 in ExtensionFunction::RunWithValidation() extensions/browser/extension_function.cc:494:10 #13 0x582bba8895d3 in extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(mojo::StructPtr, content::RenderFrameHost*, content::RenderProcessHost&, base::OnceCallback, std::__Cr::allocator> const&, mojo::StructPtr)>) extensions/browser/extension_function_dispatcher.cc:457:15 #14 0x582bba88783d in extensions::ExtensionFunctionDispatcher::Dispatch(mojo::StructPtr, content::RenderFrameHost&, base::OnceCallback, std::__Cr::allocator> const&, mojo::StructPtr)>) extensions/browser/extension_function_dispatcher.cc:191:3 #15 0x582bba872a3f in extensions::ExtensionFrameHost::Request(mojo::StructPtr, base::OnceCallback, std::__Cr::allocator> const&, mojo::StructPtr)>) extensions/browser/extension_frame_host.cc:65:9 #16 0x582bbab7a6aa in extensions::mojom::LocalFrameHostStubDispatch::AcceptWithResponder(extensions::mojom::LocalFrameHost*, mojo::Message*, std::__Cr::unique_ptr>) gen/extensions/common/mojom/frame.mojom.cc:4249:13 #17 0x582bc48cb637 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #18 0x582bc48e9163 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24 #19 0x582bc48d1943 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #20 0x582bc79e57f3 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24 #21 0x582bc79e7c75 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #22 0x582bc3b11493 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #23 0x582bc3b804bc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #24 0x582bc3b7f35a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #25 0x582bc3d2b7f8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #26 0x582bc3d2edb8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #27 0x760c7dd05718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d) previously allocated by thread T0 (chrome) here: #0 0x582bab98059d in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2e59d) (BuildId: b74558559e77a25d) #1 0x582bce301b2c in extensions::Extension::Create(base::FilePath const&, extensions::mojom::ManifestLocation, base::DictValue const&, int, std::__Cr::basic_string, std::__Cr::allocator> const&, std::__Cr::basic_string, std::__Cr::allocator>*) extensions/common/extension.cc:279:40 #2 0x582bce301610 in extensions::Extension::Create(base::FilePath const&, extensions::mojom::ManifestLocation, base::DictValue const&, int, std::__Cr::basic_string, std::__Cr::allocator>*) extensions/common/extension.cc:246:10 #3 0x582bbe675293 in extensions::InstalledLoader::Load(extensions::ExtensionInfo const&, bool) chrome/browser/extensions/installed_loader.cc:296:17 #4 0x582bbe676f76 in extensions::InstalledLoader::LoadAllExtensions(Profile*) chrome/browser/extensions/installed_loader.cc:411:7 #5 0x582bbe6143d0 in extensions::ExtensionService::Init() chrome/browser/extensions/extension_service.cc:367:31 #6 0x582bbe599523 in extensions::ChromeExtensionSystem::Shared::Init(bool) chrome/browser/extensions/chrome_extension_system.cc:308:23 #7 0x582bbe59a761 in extensions::ChromeExtensionSystem::InitForRegularProfile(bool) chrome/browser/extensions/chrome_extension_system.cc:401:12 #8 0x582bbfbdd14a in ProfileManager::DoFinalInitForServices(Profile*, bool) chrome/browser/profiles/profile_manager.cc:1591:46 #9 0x582bbfbdc382 in ProfileManager::DoFinalInit(ProfileManager::ProfileInfo*, bool) chrome/browser/profiles/profile_manager.cc:1530:3 #10 0x582bbfbcefc4 in ProfileManager::CreateAndInitializeProfile(base::FilePath const&, base::OnceCallback> (base::FilePath const&)>) chrome/browser/profiles/profile_manager.cc:1871:3 #11 0x582bbfbcbef6 in ProfileManager::GetProfile(base::FilePath const&) chrome/browser/profiles/profile_manager.cc:807:10 #12 0x582bc02ee422 in GetStartupProfile(base::FilePath const&, base::CommandLine const&) chrome/browser/ui/startup/startup_browser_creator.cc:1714:39 #13 0x582bc3791560 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:455:7 #14 0x582bc37908ec in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1449:18 #15 0x582bb73d3a4e in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1003:28 #16 0x582bb73dae91 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #17 0x582bb91184fd in content::StartupTaskRunner::RunAllTasksNow(bool) base/functional/callback.h:155:12 #18 0x582bb73d28c5 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:909:25 #19 0x582bb73de1e7 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams) content/browser/browser_main_runner_impl.cc:135:15 #20 0x582bb73cd0ba in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:28:32 #21 0x582bc030e8c1 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10 #22 0x582bc0312a08 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1331:10 #23 0x582bc0311ea0 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12 #24 0x582bc030b788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #25 0x582bc030bd8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #26 0x582bab982266 in ChromeMain chrome/app/chrome_main.cc:194:12 #27 0x760c7c82b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__memory/unique_ptr.h:265:101 in extensions::Extension::id() const Shadow bytes around the buggy address: 0x736c7aa8f200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x736c7aa8f280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x736c7aa8f300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x736c7aa8f380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x736c7aa8f400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x736c7aa8f480: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fa fa fa 0x736c7aa8f500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x736c7aa8f580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x736c7aa8f600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x736c7aa8f680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x736c7aa8f700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1322==ADDITIONAL INFO ==1322==Note: Please include this section with the ASan report. Task trace: #0 0x582bc79dee2d in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13 #1 0x582bc4965b13 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13 Command line: `/chromium/chromium/src/out/asan/chrome --no-first-run --no-default-browser-check --no-sandbox --disable-gpu --ozone-platform=headless --user-data-dir=/tmp/chrome-poc-profile --enable-logging=stderr --allowlisted-extension-id=iedmbinbpnlgcnbnlhkgpbjeonpkkohk --load-extension=/poc-artifacts/caller_app --flag-switches-begin --flag-switches-end about:blank` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==1322==END OF ADDITIONAL INFO ==1322==ABORTING [1356:1384:0520/232014.487601:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_. [1356:1384:0520/232014.487733:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.