Skip to content

Commit 9834ef8

Browse files
jasnellBethGriggs
authored andcommitted
src: retain pointers to WriteWrap/ShutdownWrap
Avoids potential use-after-free when wrap req's are synchronously destroyed. CVE-ID: CVE-2020-8265 Fixes: nodejs-private/node-private#227 Refs: https://hackerone.com/bugs?subject=nodejs&report_id=988103 PR-URL: nodejs-private/node-private#23 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
1 parent c5dbe83 commit 9834ef8

File tree

4 files changed

+68
-4
lines changed

4 files changed

+68
-4
lines changed

src/stream_base-inl.h

+8-3
Original file line numberDiff line numberDiff line change
@@ -137,8 +137,11 @@ int StreamBase::Shutdown(v8::Local<v8::Object> req_wrap_obj) {
137137
StreamReq::ResetObject(req_wrap_obj);
138138
}
139139

140+
BaseObjectPtr<AsyncWrap> req_wrap_ptr;
140141
AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(GetAsyncWrap());
141142
ShutdownWrap* req_wrap = CreateShutdownWrap(req_wrap_obj);
143+
if (req_wrap != nullptr)
144+
req_wrap_ptr.reset(req_wrap->GetAsyncWrap());
142145
int err = DoShutdown(req_wrap);
143146

144147
if (err != 0 && req_wrap != nullptr) {
@@ -172,7 +175,7 @@ StreamWriteResult StreamBase::Write(
172175
if (send_handle == nullptr) {
173176
err = DoTryWrite(&bufs, &count);
174177
if (err != 0 || count == 0) {
175-
return StreamWriteResult { false, err, nullptr, total_bytes };
178+
return StreamWriteResult { false, err, nullptr, total_bytes, {} };
176179
}
177180
}
178181

@@ -182,13 +185,14 @@ StreamWriteResult StreamBase::Write(
182185
if (!env->write_wrap_template()
183186
->NewInstance(env->context())
184187
.ToLocal(&req_wrap_obj)) {
185-
return StreamWriteResult { false, UV_EBUSY, nullptr, 0 };
188+
return StreamWriteResult { false, UV_EBUSY, nullptr, 0, {} };
186189
}
187190
StreamReq::ResetObject(req_wrap_obj);
188191
}
189192

190193
AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(GetAsyncWrap());
191194
WriteWrap* req_wrap = CreateWriteWrap(req_wrap_obj);
195+
BaseObjectPtr<AsyncWrap> req_wrap_ptr(req_wrap->GetAsyncWrap());
192196

193197
err = DoWrite(req_wrap, bufs, count, send_handle);
194198
bool async = err == 0;
@@ -206,7 +210,8 @@ StreamWriteResult StreamBase::Write(
206210
ClearError();
207211
}
208212

209-
return StreamWriteResult { async, err, req_wrap, total_bytes };
213+
return StreamWriteResult {
214+
async, err, req_wrap, total_bytes, std::move(req_wrap_ptr) };
210215
}
211216

212217
template <typename OtherBase>

src/stream_base.cc

+1-1
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
265265

266266
// Immediate failure or success
267267
if (err != 0 || count == 0) {
268-
SetWriteResult(StreamWriteResult { false, err, nullptr, data_size });
268+
SetWriteResult(StreamWriteResult { false, err, nullptr, data_size, {} });
269269
return err;
270270
}
271271

src/stream_base.h

+1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ struct StreamWriteResult {
2525
int err;
2626
WriteWrap* wrap;
2727
size_t bytes;
28+
BaseObjectPtr<AsyncWrap> wrap_obj;
2829
};
2930

3031
using JSMethodFunction = void(const v8::FunctionCallbackInfo<v8::Value>& args);
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
'use strict';
2+
3+
const common = require('../common');
4+
5+
if (!common.hasCrypto)
6+
common.skip('missing crypto');
7+
8+
const https = require('https');
9+
const tls = require('tls');
10+
11+
const kMessage =
12+
'GET / HTTP/1.1\r\nHost: localhost\r\nConnection: Keep-alive\r\n\r\n';
13+
14+
const key = `-----BEGIN EC PARAMETERS-----
15+
BggqhkjOPQMBBw==
16+
-----END EC PARAMETERS-----
17+
-----BEGIN EC PRIVATE KEY-----
18+
MHcCAQEEIDKfHHbiJMdu2STyHL11fWC7psMY19/gUNpsUpkwgGACoAoGCCqGSM49
19+
AwEHoUQDQgAEItqm+pYj3Ca8bi5mBs+H8xSMxuW2JNn4I+kw3aREsetLk8pn3o81
20+
PWBiTdSZrGBGQSy+UAlQvYeE6Z/QXQk8aw==
21+
-----END EC PRIVATE KEY-----`;
22+
23+
const cert = `-----BEGIN CERTIFICATE-----
24+
MIIBhjCCASsCFDJU1tCo88NYU//pE+DQKO9hUDsFMAoGCCqGSM49BAMCMEUxCzAJ
25+
BgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5l
26+
dCBXaWRnaXRzIFB0eSBMdGQwHhcNMjAwOTIyMDg1NDU5WhcNNDgwMjA3MDg1NDU5
27+
WjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwY
28+
SW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
29+
QgAEItqm+pYj3Ca8bi5mBs+H8xSMxuW2JNn4I+kw3aREsetLk8pn3o81PWBiTdSZ
30+
rGBGQSy+UAlQvYeE6Z/QXQk8azAKBggqhkjOPQQDAgNJADBGAiEA7Bdn4F87KqIe
31+
Y/ABy/XIXXpFUb2nyv3zV7POQi2lPcECIQC3UWLmfiedpiIKsf9YRIyO0uEood7+
32+
glj2R1NNr1X68w==
33+
-----END CERTIFICATE-----`;
34+
35+
const server = https.createServer(
36+
{ key, cert },
37+
common.mustCall((req, res) => {
38+
res.writeHead(200);
39+
res.end('boom goes the dynamite\n');
40+
}, 3));
41+
42+
server.listen(0, common.mustCall(() => {
43+
const socket =
44+
tls.connect(
45+
server.address().port,
46+
'localhost',
47+
{ rejectUnauthorized: false },
48+
common.mustCall(() => {
49+
socket.write(kMessage);
50+
socket.write(kMessage);
51+
socket.write(kMessage);
52+
}));
53+
54+
socket.on('data', common.mustCall(() => socket.destroy()));
55+
socket.on('close', () => {
56+
setImmediate(() => server.close());
57+
});
58+
}));

0 commit comments

Comments
 (0)