Cross-thread use-after-free in browser process via chrome.processes.terminate()

Summary

The chrome.processes.terminate() extension API dispatches BrowserChildProcessHost::FromID() to the IO thread, but this function and the global g_child_process_list it iterates are exclusively owned by the UI thread with no synchronization. The only guards are DCHECK_CURRENTLY_ON(BrowserThread::UI) assertions, which are compiled out in release builds. When an extension rapidly calls terminate() on non-renderer child process IDs, the IO thread iterates the list concurrently with the UI thread destroying hosts and removing list nodes, producing a heap-use-after-free in the browser process. ASAN confirms the crash is not protected by MiraclePtr. Affects all desktop platforms (Linux, macOS, Windows). Requires the processes extension permission, currently gated to dev channel.

Bisect

Introducing Commit: 98241839b528f945fabb03f38fb1ea6a3e837f09

• Date: 2016-03-11
• Author: afakhry
• Review: https://codereview.chromium.org/1584473004

Root Cause

ProcessesTerminateFunction::Run() handles two categories of process IDs. For renderer processes it resolves the handle synchronously on the UI thread via RenderProcessHost::FromID(). For non-renderer child processes (utility, GPU, etc.) it posts GetProcessHandleOnIO to the IO thread:

// chrome/browser/extensions/api/processes/processes_api.cc
content::GetIOThreadTaskRunner({})->PostTaskAndReplyWithResult(
    FROM_HERE,
    base::BindOnce(&ProcessesTerminateFunction::GetProcessHandleOnIO, this,
                   child_process_host_id_),
    base::BindOnce(&ProcessesTerminateFunction::OnProcessHandleOnUI, this));

GetProcessHandleOnIO then calls BrowserChildProcessHost::FromID(), which iterates g_child_process_list:

// content/browser/browser_child_process_host_impl.cc
BrowserChildProcessHost* BrowserChildProcessHost::FromID(int child_process_id) {
  DCHECK_CURRENTLY_ON(BrowserThread::UI);
  BrowserChildProcessHostImpl::BrowserChildProcessList* process_list =
      g_child_process_list.Pointer();
  for (BrowserChildProcessHostImpl* host : *process_list) {
    if (host->GetData().id == child_process_id)
      return host;
  }
  return nullptr;
}

The DCHECK_CURRENTLY_ON(BrowserThread::UI) assertion is the only thing preventing cross-thread access here, and it vanishes in release builds. The list type is std::list<raw_ptr<BrowserChildProcessHostImpl, CtnExperimental>>, a plain doubly-linked list with no mutex, no lock, and no sequence checker protecting it.

The race unfolds as follows. When an extension fires many terminate() calls targeting non-renderer child processes, each call queues a GetProcessHandleOnIO task on the IO thread. The first successful termination kills a child process (e.g. GPU). The process exit triggers an IPC disconnect notification that propagates through the UI thread: OnChildDisconnected invokes the host delegate’s destructor, which calls ForceShutdown():

// content/browser/browser_child_process_host_impl.cc
void BrowserChildProcessHostImpl::ForceShutdown() {
  DCHECK_CURRENTLY_ON(BrowserThread::UI);
  g_child_process_list.Get().remove(this);
  child_process_host_->ForceShutdown();
}

This std::list::remove unlinks and frees the list node on the UI thread. Meanwhile, the IO thread is still processing queued FromID() calls, iterating the same list by following next pointers through heap-allocated std::list nodes. When it dereferences a node that the UI thread has already freed, ASAN detects a heap-use-after-free.

The freed 24-byte region is a std::list node containing the raw_ptr<BrowserChildProcessHostImpl> element plus the prev/next pointers. ASAN’s additional information confirms “MiraclePtr Status: NOT PROTECTED” because the use-after-free is on the list node itself, not on a raw_ptr-managed object.

A contrasting example exists within the same class. BrowserChildProcessHostIterator (used by code that legitimately needs to enumerate child processes) enforces DCHECK_CURRENTLY_ON(BrowserThread::UI) and is only called from UI-thread code paths. The processes.terminate() handler is the sole caller that incorrectly dispatches FromID() to the IO thread.

Reproduce

Tested at commit f7d73bbd27f24 on Linux x86_64 with the out/asan-release build configuration.

The PoC is a Manifest V3 extension that enumerates non-renderer child processes via chrome.processes.getProcessInfo() and fires concurrent terminate() calls to race the IO-thread lookup against UI-thread host destruction. The directory doubles as a loadable unpacked extension:

issue_processes_terminate_race_uaf/
├── manifest.json      # MV3 extension manifest
├── background.js      # PoC service worker

A 5ms sleep is inserted in BrowserChildProcessHost::FromID() to widen the race window for reliable reproduction. Apply patch.diff and rebuild:

cd ~/chromium/src
git apply issue_processes_terminate_race_uaf/patch.diff
autoninja -C out/asan-release chrome

Load the extension directory and launch:

ASAN_OPTIONS=detect_odr_violation=0 \
  xvfb-run -a out/asan-release/chrome \
  --disable-gpu \
  --enable-experimental-extension-apis \
  --load-extension=issue_processes_terminate_race_uaf \
  --user-data-dir=/tmp/poc-$(date +%s) \
  --no-first-run \
  about:blank

The browser process crashes within seconds with a heap-use-after-free in BrowserChildProcessHost::FromID() on the IO thread, while the UI thread frees a list node via ForceShutdown().

==1272169==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b73c90c1d48 at pc 0x7f443311242c bp 0x7b43b7044f70 sp 0x7b43b7044f68
READ of size 8 at 0x7b73c90c1d48 thread T10 (Chrome_IOThread)
    #0 content::BrowserChildProcessHost::FromID(int) content/browser/browser_child_process_host_impl.cc:142
    #1 extensions::ProcessesTerminateFunction::GetProcessHandleOnIO(int) chrome/browser/extensions/api/processes/processes_api.cc:524

freed by thread T0 (chrome) here:
    #0 operator delete(void*, unsigned long)
    #1 std::__Cr::list<...>::remove(...) gen/third_party/libc++/src/include/__new/allocate.h:63
    #2 content::BrowserChildProcessHostImpl::ForceShutdown() content/browser/browser_child_process_host_impl.cc:268
    #3 content::GpuProcessHost::ValidateHost(content::GpuProcessHost*) content/browser/gpu/gpu_process_host.cc:1249

previously allocated by thread T0 (chrome) here:
    #0 operator new(unsigned long)
    #1 content::BrowserChildProcessHostImpl::BrowserChildProcessHostImpl(...)

SUMMARY: AddressSanitizer: heap-use-after-free content/browser/browser_child_process_host_impl.cc:142 in content::BrowserChildProcessHost::FromID(int)

MiraclePtr Status: NOT PROTECTED

Full ASAN log is in asan.log.

Credit

Please use c6eed09fc8b174b0f3eebedcceb1e792 as the credit for this vulnerability. Thank you.