WebGL use-after-free and memory corruption

WebGL use-after-free and memory corruption

Announced

August 28, 2012

Reporter

miaubiz

Impact

Critical

Products

Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR

Fixed in

• Firefox 15
• Firefox ESR 10.0.7
• SeaMonkey 2.12
• Thunderbird 15
• Thunderbird ESR 10.0.7

Description

Security researcher miaubiz used the Address Sanitizer tool to discover two WebGL issues. The first issue is a use-after-free when WebGL shaders are called after being destroyed. The second issue exposes a problem with Mesa drivers on Linux, leading to a potentially exploitable crash.

References

• use after free, webgl fragment shader deleted by accessor
• CVE-2012-3968

• stack scribbling with 4-byte values choosable among a few values, when using more than 16 sampler uniforms, on Mesa, with all drivers
• CVE-2012-3967