Chrome GPU Process MailboxManagerImpl Double Read
Posted by deepcore on June 16, 2016 – 10:46 pm
Several functions in the GPU command buffer service interact with the GPU mailbox manager (gpu/command_buffer/service/mailbox_manager_impl.cc), passing a reference to shared memory as the mailbox argument. MailboxManagerImpl does not expect this mailbox argument to be malleable in this way, and it is in several places copied and passed to various stl functions, resulting in unexpected behavior from double-reads when an attacker modifies the mailbox name mid function.
Post a reply
You must be logged in to post a comment.