FF Sandbox Escape

https://googleprojectzero.blogspot.com/2020/06/ff-sandbox-escape-cve-2020-12388.html?m=1

by weinzierl • 6 years ago

126 24 6 years ago

googleprojectzero.blogspot.com

Off topic but does project zero ever publish vulnerabilities on google products? More and more it seems like they mostly target google's competitors (Firefox, iOS, etc)

comfydragon• 6 years ago

Sure.

https://googleprojectzero.blogspot.com/2019/11/bad-binder-an...

https://googleprojectzero.blogspot.com/2020/02/mitigations-a...

https://googleprojectzero.blogspot.com/2016/12/chrome-os-exp...

jbroman• 6 years ago

The very first sentence points to a PZ blog post about the Chrome sandbox.

jgon• 6 years ago

The very first sentence points to a PZ blog post about a Windows vulnerability that affects the Chrome sandbox, not an issue with their own code.

simcop2387• 6 years ago

As siblings mentioned they do, I think part of the impression is a bit of a selection bias. Because Google puts itself into so many domains they have many many possible competitors. PZ tries to look at everything so they're bound to also look at google's competitors and find things. So even if they report on both themselves and on competitors, the numbers immediately look like they're reporting more on competitors because the number of companies involved is larger.

albntomat02• 6 years ago

Here's the post I put together when this same question was asked 6 days ago. All counts are rough numbers.

Project zero posts:

Google: 24

Apple: 28

Microsoft: 36

I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: https://bugs.chromium.org/p/project-zero/issues/list For all issues, including closed:

product=Android returns 81 results

product=iOS returns 58

vendor=Apple returns 380

vendor=Google returns 145 (bugs in Samsung's Android kernel,etc. are tracked separately)

vendor=Linux return 54

To be fair, a huge number of things make this not an even comparison, including the underlying bug rate, different products and downstream Android vendors being tracked separately. Also, # bugs found != which ones they choose to write about.

Sniffnoy• 6 years ago

Non-mobile link: https://googleprojectzero.blogspot.com/2020/06/ff-sandbox-es...

etaioinshrdlu• 6 years ago

It looks like this is not an actual exploit, but a hole in the sandbox that first requires injecting custom code into the process?

albntomat02• 6 years ago

I guess it depends on how you define "exploit." I'd personally consider bypassing the sandbox an exploit, even though it's not a full chain.

dathinab• 6 years ago

In the end the sandbox is there to provide some limited security even in presence of other vulnerabilities.

So I would say it's a security critical bug a sandbox escape and a building blog for an exploit but not a exploit by itself.

Anyway it's sill a security vulnerability.

kevingadd• 6 years ago

All the big browser attacks require exploit chains, and this is a component for creating an exploit chain. The best exploit chains can go all the way from a web page's JS to complete root access (this was achieved on Chromebooks at one point in the last couple years, using webassembly as one of the hops in the chain)

tiraniddo• 6 years ago

It’s an proof of concept exploit for a vulnerability in the sandbox used by FF which is a security boundary to reduce the impact of RCE. The reason for the injection is I don’t just have a working RCE lying around (we get them fixed) and using one would add additional complications and obfuscate the bug when reporting. The purpose of a proof of concept is to demonstrate impact so that it can be fixed.

starlig-ht• 6 years ago

"Sandbox Escape" sounded like something fun but alas

2close4comfort• 6 years ago

Meh...escape must mean something different at Google

staticassertion2• 6 years ago

What do you mean?

Thorrez• 6 years ago

Off topic, does Firefox depend on Chromium code?

As I’m a Chromium committer as well as an owner of the Windows sandbox I realized I might be better placed to fix this than Mozilla who relied on our code.

0xcoffee• 6 years ago

I know they use the v8 regex engine: https://hacks.mozilla.org/2020/06/a-new-regexp-engine-in-spi...

keeperofdakeys• 6 years ago

Firefox uses some of the chromium code/libraries for the sandboxing on Windows.

https://wiki.mozilla.org/Security/Sandbox/Specifics

fluffything• 6 years ago

I thought one of the main point of Firefox would be to not do this :D

half-kh-hacker• 6 years ago

My one run-in with this has been that Firefox and Chromium both use libwebrtc, which is managed by the Chromium project as far as I can tell.

FF Sandbox Escape

Related Stories