Chrome · DevTools
CVE-2025-0762
UAF in DevTools
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
CORE_EXPORTthird_party/blink/renderer/core/inspector/devtools_agent.h |
modified | |
Clientthird_party/blink/renderer/core/inspector/devtools_agent.h |
modified |
Files Changed
third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.hthird_party/blink/renderer/core/inspector/devtools_agent.ccthird_party/blink/renderer/core/inspector/devtools_agent.hthird_party/blink/renderer/core/inspector/worker_inspector_controller.h
Patch
From bc43bccd60f6d79d329ed70231547d75ac57bd4b Mon Sep 17 00:00:00 2001
From: Andrey Kosyakov <caseq@chromium.org>
Date: Wed, 15 Jan 2025 10:17:13 -0800
Subject: [PATCH] Make DevToolsAgent::Client a GCMixin, since the implementation is GCed
We used to keep a raw pointer to Client in DevToolsAgent, which does
not play well when the implementation is getting collected.
Bug: 384844003
Change-Id: Id34886635955133f0be746a9e6e910f9e6891dbf
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6175790
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1406819}
---
diff --git a/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h b/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h
index 73d5b643..e7c60ea 100644
--- a/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h
+++ b/third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.h
@@ -66,7 +66,7 @@
WebDevToolsAgentImpl(WebLocalFrameImpl*);
~WebDevToolsAgentImpl() override;
- virtual void Trace(Visitor*) const;
+ void Trace(Visitor*) const override;
DevToolsAgent* GetDevToolsAgent() const { return agent_.Get(); }
void WillBeDestroyed();
diff --git a/third_party/blink/renderer/core/inspector/devtools_agent.cc b/third_party/blink/renderer/core/inspector/devtools_agent.cc
index 27aa9471..c57c5fc 100644
--- a/third_party/blink/renderer/core/inspector/devtools_agent.cc
+++ b/third_party/blink/renderer/core/inspector/devtools_agent.cc
@@ -189,6 +189,7 @@
DevToolsAgent::~DevToolsAgent() = default;
void DevToolsAgent::Trace(Visitor* visitor) const {
+ visitor->Trace(client_);
visitor->Trace(associated_receiver_);
visitor->Trace(host_remote_);
visitor->Trace(associated_host_remote_);
diff --git a/third_party/blink/renderer/core/inspector/devtools_agent.h b/third_party/blink/renderer/core/inspector/devtools_agent.h
index f44494a..acf99dd 100644
--- a/third_party/blink/renderer/core/inspector/devtools_agent.h
+++ b/third_party/blink/renderer/core/inspector/devtools_agent.h
@@ -40,7 +40,7 @@
class CORE_EXPORT DevToolsAgent : public GarbageCollected<DevToolsAgent>,
public mojom::blink::DevToolsAgent {
public:
- class Client {
+ class Client : public GarbageCollectedMixin {
public:
virtual ~Client() = default;
virtual void AttachSession(DevToolsSession*, bool restore) = 0;
@@ -139,7 +139,7 @@
void ReportChildTargetsImpl(bool report,
bool wait_for_debugger,
base::OnceClosure callback);
- Client* client_;
+ Member<Client> const client_;
// DevToolsAgent is not tied to ExecutionContext
HeapMojoAssociatedReceiver<mojom::blink::DevToolsAgent, DevToolsAgent>
associated_receiver_{this, nullptr};
diff --git a/third_party/blink/renderer/core/inspector/worker_inspector_controller.h b/third_party/blink/renderer/core/inspector/worker_inspector_controller.h
index 400ad43..50c7d78 100644
--- a/third_party/blink/renderer/core/inspector/worker_inspector_controller.h
+++ b/third_party/blink/renderer/core/inspector/worker_inspector_controller.h
@@ -72,7 +72,7 @@
WorkerInspectorController& operator=(const WorkerInspectorController&) =
delete;
~WorkerInspectorController() override;
- void Trace(Visitor*) const;
+ void Trace(Visitor*) const override;
CoreProbeSink* GetProbeSink() const { return probe_sink_.Get(); }
DevToolsAgent* GetDevToolsAgent() const { return agent_.Get(); }
Loading diff…
Original Bug Report
reported by as...@gmail.com
use-after-poison in blink::DevToolsSession::DispatchProtocolCommandImpl
VULNERABILITY DETAILS UAP in blink::DevToolsSession::DispatchProtocolCommandImpl
VERSION Chrome Version: 133.0.6889.0(Developer Build) Operating System: Ubuntu 24.04
REPRODUCTION CASE
- put manifest.json/background.js into the extension_path
- run the command: ./chrome –user-data-dir=./noexist –no-sandbox –load-extension=“extension_path”
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: renderer Crash State: see asan.log file
CREDIT INFORMATION Externally reported security bugs may appear in Chrome release notes. If this bug is included, how would you like to be credited? Reporter credit: Sakana.S
References
On This Page