Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tom
 Type:  defect| Status:  assigned
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 Tor Browser 9.0.9: still RWX pages in the Main Process.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tom
 Type:  defect| Status:  assigned
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by cypherpunks):

 * owner:  tbb-team => tom
 * status:  needs_information => assigned


Comment:

 https://android.googlesource.com/platform/bionic/+/master/android-changes-
 for-ndk-developers.md#Writable-and-Executable-Segments-Enforced-for-API-
 level-26

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+---
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by cypherpunks):

 Replying to [comment:17 gk]:
 > Replying to [comment:16 cypherpunks]:
 > > Please add #22917 as `--enable-auto-import` is still making holes.
 >
 > Which holes are due to `--enable-auto-import`? I.e. they go away if
 compiled with `--disable-auto-import`?
 Unfortunately, Arthur's patch of `--enable-auto-import` isn't sufficient.
 Disabling this bug-or-feature is the right way to go.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+---
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by gk):

 Replying to [comment:16 cypherpunks]:
 > Please add #22917 as `--enable-auto-import` is still making holes.

 Which holes are due to `--enable-auto-import`? I.e. they go away if
 compiled with `--disable-auto-import`?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+---
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by cypherpunks):

 Please add #22917 as `--enable-auto-import` is still making holes.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+---
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---
Changes (by cypherpunks):

 * status:  new => needs_information


Comment:

 Replying to [comment:3 cypherpunks]:
 > ticket:21617#comment:7 shows that with, e.g. Process Hacker, it's
 possible to find out what images have RWX pages. Those 2 images belong to
 Windows 7: its part, known as Media Foundation (itself and audio codec).
 The most recent version of Windows 10 doesn't have this problem.
 > To force Firefox to load MF you can use https://www.youtube.com/html5
 Maybe, Tom Ritter could write an official letter to Microsoft?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 Replying to [comment:11 cypherpunks]:
 > Replying to [comment:9 arthuredelstein]:
 > > Replying to [comment:8 cypherpunks]:
 > > > TBB 7.5a1 on Win 7: 10 private RWX pages are observable.
 > > > {{{
 > > > ││   ├──0.04 MB (00.00%) ── execute-readwrite(segments=1)
 > > > }}}
 > > >
 > > > {{{
 > > > 0x426, Private: Commit, 40 kB, RWX
 > > > }}}
 > >
 > > Thanks. Could you check what DLLs (or exe) these pages are associated
 with? VMMap will tell you (https://technet.microsoft.com/en-
 us/sysinternals/vmmap.aspx).
 > Well, it's a private block of the main firefox.exe process.
 In 7.5a4 content process has a similar block (with different data in it).
 Main process has another one 4K RWX private page.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 Some linker fun:
 {{{
 --enable-auto-import
 Do sophisticated linking of _symbol to __imp__symbol for DATA imports
 from DLLs, and create the necessary thunking symbols when building the
 import libraries with those DATA exports. Note: Use of the 'auto-import'
 extension will cause the text section of the image file to be made
 writable. This does not conform to the PE-COFF format specification
 published by Microsoft.
 }}}

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 Replying to [comment:10 arthuredelstein]:
 > I did some more investigation and posted a question on the mingw-w64
 help discussion board:
 https://sourceforge.net/p/mingw-w64/discussion/723798/thread/2f2c014b/
 Maybe, it would be easier to track this down with Tor Expert Bundle first.
 Compiling without SSP and then without all flags could also help.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 Replying to [comment:9 arthuredelstein]:
 > Replying to [comment:8 cypherpunks]:
 > > TBB 7.5a1 on Win 7: 10 private RWX pages are observable.
 > > {{{
 > > ││   ├──0.04 MB (00.00%) ── execute-readwrite(segments=1)
 > > }}}
 > >
 > > {{{
 > > 0x426, Private: Commit, 40 kB, RWX
 > > }}}
 >
 > Thanks. Could you check what DLLs (or exe) these pages are associated
 with? VMMap will tell you (https://technet.microsoft.com/en-
 us/sysinternals/vmmap.aspx).
 Well, it's a private block of the main firefox.exe process.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by arthuredelstein):

 I did some more investigation and posted a question on the mingw-w64 help
 discussion board:
 https://sourceforge.net/p/mingw-w64/discussion/723798/thread/2f2c014b/

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by arthuredelstein):

 Replying to [comment:8 cypherpunks]:
 > TBB 7.5a1 on Win 7: 10 private RWX pages are observable.
 > {{{
 > ││   ├──0.04 MB (00.00%) ── execute-readwrite(segments=1)
 > }}}
 >
 > {{{
 > 0x426, Private: Commit, 40 kB, RWX
 > }}}

 Thanks. Could you check what DLLs (or exe) these pages are associated
 with? VMMap will tell you (https://technet.microsoft.com/en-
 us/sysinternals/vmmap.aspx).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 TBB 7.5a1 on Win 7: 10 private RWX pages are observable.
 {{{
 ││   ├──0.04 MB (00.00%) ── execute-readwrite(segments=1)
 }}}

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by arthuredelstein):

 Replying to [comment:4 cypherpunks]:
 > ticket:21617#comment:14 is about `softokn3.dll` and `freebl3.dll` have
 `W^X` pages on Windows 10 (15063) for unknown reason.
 > `about:support` page is a good way to force lazyloaders in Firefox to
 load DLLs.

 I'm able to reproduce the RWX pages for these two DLLs. They are all
 labeled ".text", which leads me to assembly code in the freebl and
 softoken parts of the mozilla codebase. But I don't see anything
 explicitly requesting RWX or X/COW memory.

 Interestingly, I don't see these RWX pages in the latest release version
 of Firefox. And, if I build tor-browser.git using `./mach build` on
 Windows, I also don't see any RWX pages. That suggests to me that the RWX
 pages observed in TBB may be related to how we are building tor-
 browser.git with mingw32-gcc.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by arthuredelstein):

 Thanks for these very useful details!

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 Replying to [comment:4 cypherpunks]:
 > ticket:21617#comment:14 is about `softokn3.dll` and `freebl3.dll` have
 `W^X` pages on Windows 10 (15063) for unknown reason.
 The same happens on Windows 7 right from the start (chrome process only).
 And it's a great improvement since 6.5, where much more libs had `W^X`
 pages.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 ticket:21617#comment:14 is about `softokn3.dll` and `freebl3.dll` have
 `W^X` pages on Windows 10 (15063) for unknown reason.
 `about:support` page is a good way to force lazyloaders in Firefox to load
 DLLs.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 ticket:21617#comment:7 shows that with, e.g. Process Hacker, it's possible
 to find out what images have RWX pages. Those 2 images belong to Windows
 7: its part, known as Media Foundation (itself and audio codec). The most
 recent version of Windows 10 doesn't have this problem.
 To force Firefox to load MF you can use https://www.youtube.com/html5

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 ticket:21617#comment:4 is about `about:memory` in Tor Browser, where under
 Other Measurements section it shows general information from
 MEMORY_BASIC_INFORMATION about memory address space for each process
 separately. `execute-readwrite` in `image` means RWX pages in executable
 images (EXEs, DLLs).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #22584 [Applications/Tor Browser]: More RWX memory pages for TBB on some Windows versions

[Tor Bug Tracker & Wiki]

#22584: More RWX memory pages for TBB on some Windows versions
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-security  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Description changed by arthuredelstein:

Old description:

> A cypherpunk has reported some RWX memory pages were observed on some
> Windows 7 and Windows 10. See:
> * ticket:21617#comment:4
> * ticket:21617#comment:7
> * ticket:21617#comment:14

New description:

 A cypherpunk has reported some RWX memory pages were observed for Tor
 Browser on Windows 7 and Windows 10. See:
 * ticket:21617#comment:4
 * ticket:21617#comment:7
 * ticket:21617#comment:14

--

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs