Chrome: SandboxedUnpacker unsafe use of shared memory.

If we look at the mojo interface gzipper.mojom (services/data_decoder/public/mojom/gzipper.mojom):

// An interface that lets callers compress and uncompress data using gzip.
interface Gzipper {
 // Compresses |data| using gzip and returns it as |compressed_data|. Returns
 // null if compression fails.
 Compress(mojo_base.mojom.BigBuffer data)
   => (mojo_base.mojom.BigBuffer? compressed_data);

 // Uncompresses |compressed_data| using gzip and returns it as |data|. Returns
 // null if uncompression fails.
 Uncompress(mojo_base.mojom.BigBuffer compressed_data)
   => (mojo_base.mojom.BigBuffer? data);
};

It's interesting already since the service appears to be doing a gzip decompression
directly from data in shared memory. However, this is architected so that the caller
of these interfaces is (at present) always a trusted process, and that the service
implementing this service is a less-privileged sandboxed utility service.

We can see that Uncompress returns a BigBuffer, which may be backed by shared
memory. If we look at the callsites for DataDecoder::GzipUncompress, this leads
us to SandboxedUnpacker:

void SandboxedUnpacker::UnzipDone(const base::FilePath& zip_file,
                 const base::FilePath& unzip_dir,
                 const std::string& error) {
 DCHECK(unpacker_io_task_runner_->RunsTasksInCurrentSequence());

 if (!error.empty()) {
  ReportFailure(SandboxedUnpackerFailureReason::UNZIP_FAILED,
         l10n_util::GetStringUTF16(IDS_EXTENSION_PACKAGE_UNZIP_ERROR));
  return;
 }
 base::FilePath verified_contents_path =
   file_util::GetVerifiedContentsPath(extension_root_);
 // If the verified contents are already present in the _metadata folder, we
 // can ignore the verified contents in the header.
 if (compressed_verified_contents_.empty() ||
   base::PathExists(verified_contents_path)) {
  Unpack(unzip_dir);
  return;
 }
 data_decoder_.GzipUncompress(
   compressed_verified_contents_,
   base::BindOnce(&SandboxedUnpacker::OnVerifiedContentsUncompressed, this,
          unzip_dir));
}

Once this receives the response from the DataDecoder, it passes the memory 
returned in the BigBuffer directly into StoreVerifiedContentsInExtensionDir:

void SandboxedUnpacker::OnVerifiedContentsUncompressed(
  const base::FilePath& unzip_dir,
  data_decoder::DataDecoder::ResultOrError<mojo_base::BigBuffer> result) {
 DCHECK(unpacker_io_task_runner_->RunsTasksInCurrentSequence());
 if (!result.value) {
  ReportFailure(
    SandboxedUnpackerFailureReason::
      CRX_HEADER_VERIFIED_CONTENTS_UNCOMPRESSING_FAILURE,
    l10n_util::GetStringFUTF16(
      IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
      ASCIIToUTF16(
        \"CRX_HEADER_VERIFIED_CONTENTS_UNCOMPRESSING_FAILURE\")));
  return;
 }
 if (!StoreVerifiedContentsInExtensionDir(result.value.value().byte_span()))
  return;
 Unpack(unzip_dir);
}

bool SandboxedUnpacker::StoreVerifiedContentsInExtensionDir(
  base::span<const uint8_t> verified_contents) {
 DCHECK(unpacker_io_task_runner_->RunsTasksInCurrentSequence());

 if (!VerifiedContents::Create(
     ContentVerifierKey(kWebstoreSignaturesPublicKey,
              kWebstoreSignaturesPublicKeySize),
     {reinterpret_cast<const char*>(verified_contents.data()),
     verified_contents.size()})) {
  ReportFailure(SandboxedUnpackerFailureReason::MALFORMED_VERIFIED_CONTENTS,
         l10n_util::GetStringFUTF16(
           IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
           ASCIIToUTF16(\"MALFORMED_VERIFIED_CONTENTS\")));
  return false;
 }

 //...

Following this leads us further down:

std::unique_ptr<VerifiedContents> VerifiedContents::Create(
  base::span<const uint8_t> public_key,
  base::StringPiece contents) {
 ScopedUMARecorder<kUMAVerifiedContentsInitTime,
          kUMAVerifiedContentsInitResult>
   uma_recorder;
 // Note: VerifiedContents constructor is private.
 auto verified_contents = base::WrapUnique(new VerifiedContents(public_key));
 std::string payload;
 if (!verified_contents->GetPayload(contents, &payload))
  return nullptr;

And the first thing that VerifiedContents::GetPayload does is to parse this
data as JSON. Note that at this point, the StringPiece contents is still backed
by shared memory.

bool VerifiedContents::GetPayload(base::StringPiece contents,
                 std::string* payload) {
 base::Optional<base::Value> top_list = base::JSONReader::Read(contents);
 if (!top_list || !top_list->is_list())
  return false;

I haven't verified that base::JSONReader does anything dangerous when given an
input backed by shared memory; it actually looks like most of the code in there
will manage to handle this unexpected situation fairly gracefully, although it
definitely seems to be outside of the intended usage (and eg. ICU code comes in
to play here as well...)

In any case, the next thing that StoreVerifiedContentsInExtensionDir does is 
(after verifying the signatures and stuff in the JSON it parsed) to write the 
contents of the shared memory out to disk; the attacker could change those 
contents between the JSON parse and the final version being written to disk, 
and they should be able to effectively bypass all of the checks in 
VerifiedContents::Create.

bool SandboxedUnpacker::StoreVerifiedContentsInExtensionDir(
    base::span<const uint8_t> verified_contents) {
  DCHECK(unpacker_io_task_runner_->RunsTasksInCurrentSequence());

  if (!VerifiedContents::Create(
          ContentVerifierKey(kWebstoreSignaturesPublicKey,
                             kWebstoreSignaturesPublicKeySize),
          {reinterpret_cast<const char*>(verified_contents.data()),
           verified_contents.size()})) {
    ReportFailure(SandboxedUnpackerFailureReason::MALFORMED_VERIFIED_CONTENTS,
                  l10n_util::GetStringFUTF16(
                      IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
                      ASCIIToUTF16(\"MALFORMED_VERIFIED_CONTENTS\")));
    return false;
  }

  base::FilePath metadata_path = extension_root_.Append(kMetadataFolder);
  if (!base::CreateDirectory(metadata_path)) {
    ReportFailure(
        SandboxedUnpackerFailureReason::COULD_NOT_CREATE_METADATA_DIRECTORY,
        l10n_util::GetStringFUTF16(
            IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
            ASCIIToUTF16(\"COULD_NOT_CREATE_METADATA_DIRECTORY\")));
    return false;
  }

  base::FilePath verified_contents_path =
      file_util::GetVerifiedContentsPath(extension_root_);

  // Cannot write the verified contents file.
  if (!base::WriteFile(verified_contents_path, verified_contents)) { // <-- verified_contents is still pointing to the shared memory
    ReportFailure(
        SandboxedUnpackerFailureReason::
            COULD_NOT_WRITE_VERIFIED_CONTENTS_INTO_FILE,
        l10n_util::GetStringFUTF16(
            IDS_EXTENSION_PACKAGE_INSTALL_ERROR,
            ASCIIToUTF16(\"COULD_NOT_WRITE_VERIFIED_CONTENTS_INTO_FILE\")));
    return false;
  }

  return true;
}

This bug is subject to a 90 day disclosure deadline. After 90 days elapse,
the bug report will become visible to the public. The scheduled disclosure
date is 2021-06-11. Disclosure at an earlier date is possible if
agreed upon by all parties.





Found by: markbrand@google.com