vendor:
OpenGL Texture Bindings
by:
Unspecified
7.8
CVSS
HIGH
Object Lifetime Issue
400
CWE
Product Name: OpenGL Texture Bindings
Affected Version From: All versions of TextureXX::copyImage
Affected Version To: 68.0.3440.7
Patch Exists: Yes
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Javascript
2018
Object Lifetime Issue in Swiftshader OpenGL Texture Bindings
There is an object lifetime issue in the Swiftshader OpenGL texture bindings (OpenGL/libGLESv2/Texture.cpp). The same bug is present in all versions of TextureXX::copyImage. The bug is triggered when egl::Image::create fails and the reference taken on renderTarget by source->getRenderTarget() is never dropped. The PoC is tested against 68.0.3440.7, and for versions prior to the fixes a different strategy (or at least texture sizes) will be needed to cause the allocations to fail. Note that the PoC is triggering the bug directly from javascript, which will taint the renderer process, so it's not possible to use this bug to escape the sandbox.
Mitigation:
Update to the latest version of Swiftshader OpenGL texture bindings.