Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A potential heap use-after-free vulnerability exists in Skia’s Graphite Dawn backend (DawnGraphicsPipeline.cpp) due to the reallocation of a TArray holding static sampler layouts while pointers to its elements are still held in a descriptor chain. When the layout is subsequently processed during bind group layout creation, the deallocated memory is traversed, potentially leading to a GPU process crash or code execution.

Affected files:

• third_party/skia/src/gpu/graphite/dawn/DawnGraphicsPipeline.cpp

Estimated timestamp from git blame: 2024-10-03

Description

A potential heap use-after-free (UAF) vulnerability has been identified in DawnGraphicsPipeline::Make() within Skia’s Graphite Dawn backend (third_party/skia/src/gpu/graphite/dawn/DawnGraphicsPipeline.cpp).

The issue stems from the lifecycle management of skia_private::TArray<wgpu::StaticSamplerBindingLayout> staticSamplerLayouts during the creation of a bind group layout.

Detailed Analysis

In DawnGraphicsPipeline::Make(), a local vector is declared to hold static sampler layouts:

skia_private::TArray<wgpu::StaticSamplerBindingLayout> staticSamplerLayouts;

As the loop iterates over textures and samplers, if a sampler is immutable, a layout is added to the array and its address is saved into the stack-allocated entries array:

wgpu::StaticSamplerBindingLayout& immutableSamplerBinding =
        staticSamplerLayouts.emplace_back();
...
entries[i].nextInChain = &immutableSamplerBinding;

Because staticSamplerLayouts is default-constructed with a capacity of 0 and is not pre-reserved, appending elements can trigger a vector reallocation. When TArray::emplace_back() exhausts its capacity, it reallocates the underlying buffer via growAndConstructAtEnd() -> installDataAndUpdateCapacity(), move-constructs elements to the new buffer, and frees the old buffer via sk_free().

If a reallocation occurs, any pointers already stored in entries[*].nextInChain pointing to the previous array storage become dangling.

Later, Dawn processes these entries inside device.CreateBindGroupLayout(&groupLayoutDesc). In release builds, DeviceBase::CreateBindGroupLayout calls ConvertAndExpandBGLEntries(), which invokes the generated Unpack<BindGroupLayoutEntry>() function. This function traverses the linked list starting at the dangling nextInChain pointer.

If an attacker is able to reclaim and populate the freed heap memory before the unpack traversal, they could control the structure’s sType and sampler pointer. When StaticSamplerBindingInfo::From() is called, it constructs a Ref<SamplerBase>{layout.sampler}, which increments and decrements the reference count at an attacker-controlled offset and potentially triggers a virtual method call on destruction, leading to arbitrary code execution within the GPU process.

Triggering Preconditions

On 64-bit systems, the first allocation of staticSamplerLayouts is rounded up to a minimum capacity of 8 elements (256 bytes, fitting PartitionAlloc’s 256-byte bucket). Thus, a pipeline containing 9 or more immutable (Vulkan YCbCr) samplers is required to trigger a reallocation. Under normal operation, immutable samplers are typically produced only for textures backed by a YCbCr descriptor (such as Android AHardwareBuffer SharedImages).

Potential Steps to Reproduce (Theoretical)

Note: These are potential steps based on source code analysis; our tools do not currently have the capability to run code or verify this dynamically.

1. From a compromised renderer, serialize OOP-R paint commands that reference 9 or more distinct, unique AHardwareBuffer-backed YCbCr images in a single paint shader/filter tree.
2. Ensure the resulting pipeline description is unique to prevent hitting the pipeline cache.
3. Once the raster command is executed, the GPU process calls DawnGraphicsPipeline::Make(). On the 9th immutable sampler, staticSamplerLayouts reallocates, leaving dangling pointers in entries[0..7].nextInChain.
4. Concurrently, spray the PartitionAlloc 256-byte bucket to reclaim the freed block and overwrite its contents with forged layout descriptions.
5. When device.CreateBindGroupLayout() parses the entries, it traverses the forged chained layouts, performing refcount increments and virtual calls.

Suggested Fix

To resolve this issue, reserve sufficient capacity in staticSamplerLayouts prior to entering the loop. Since the maximum possible number of static samplers is bounded by numTexturesAndSamplers / 2, pre-allocating or reserving this capacity prevents any subsequent reallocation:

skia_private::TArray<wgpu::StaticSamplerBindingLayout> staticSamplerLayouts;
staticSamplerLayouts.reserve(numTexturesAndSamplers / 2);

Evaluated with Chrome root at commit: e9507a33bb4148ee071aaaf8a7e9ad68770359bf

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.