Mozilla Foundation Security Advisory 2011-41
Potentially exploitable WebGL crashes
- Announced
- September 27, 2011
- Reporter
- Michael Jordan, Ben Hawkes
- Impact
- Critical
- Products
- Firefox, SeaMonkey
- Fixed in
-
- Firefox 7
- SeaMonkey 2.4
Description
Michael Jordon of Context IS reported that in the ANGLE
library used by WebGL the return value from GrowAtomTable()
was not checked for errors. If an attacker could cause requests that
exceeded the available memeory those would fail and potentially lead
to a buffer overrun as subsequent code wrote into the non-allocated space.
Ben Hawkes of the Google Security Team reported a WebGL test case that demonstrated an out of bounds write after an allocation failed.