Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 808e77190fcf15156e06761c31e79230b166c8d0
https://github.com/WebKit/WebKit/commit/808e77190fcf15156e06761c31e79230b166c8d0
Author: Chris Dumez <[email protected]>
Date: 2026-07-27 (Mon, 27 Jul 2026)
Changed paths:
M LayoutTests/http/wpt/webauthn/ctap-hid-failure.https-expected.txt
M LayoutTests/http/wpt/webauthn/ctap-hid-failure.https.html
M Source/WebCore/testing/MockWebAuthenticationConfiguration.h
M Source/WebCore/testing/MockWebAuthenticationConfiguration.idl
M Source/WebKit/Shared/WebCoreArgumentCodersAuth.serialization.in
M Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp
M Source/WebKit/UIProcess/WebAuthentication/fido/CtapHidDriver.cpp
Log Message:
-----------
Out-of-bounds read in CtapHidDriver when a CTAPHID_INIT response is too short
https://bugs.webkit.org/show_bug.cgi?id=320344
rdar://problem/183363731
Reviewed by Pascoe.
CtapHidDriver::continueAfterChannelAllocated() reads the 4-byte channel ID from
payload[8..11] of the CTAPHID_INIT response after only checking that the payload
begins with the requested nonce. spanHasPrefix() merely requires the payload to
be at least as long as the 8-byte nonce, and the size assumption was otherwise
only enforced by a debug-only ASSERT(payload.size() == kHidInitResponseSize). A
malicious or buggy authenticator can therefore return an INIT response whose
payload matches the nonce prefix but is shorter than kHidInitResponseSize (as
few as 8 bytes), causing an out-of-bounds Vector access when reading the channel
ID. Under WebKit's bounds-checked Vector this crashes the UI process.
Treat a too-short response the same as a nonce mismatch: replace the debug
assertion with a runtime `payload.size() < kHidInitResponseSize` check folded
into the existing restart condition, so the transaction is restarted (and
eventually times out) instead of reading past the buffer.
To make the vulnerable path testable, add a "short-init-response" mock HID
error. MockHidConnection previously always produced a well-formed
kHidInitResponseSize-byte INIT response; it now emits a payload consisting of
just the nonce when this error is configured.
No new tests, updated http/wpt/webauthn/ctap-hid-failure.https.html.
* LayoutTests/http/wpt/webauthn/ctap-hid-failure.https-expected.txt:
* LayoutTests/http/wpt/webauthn/ctap-hid-failure.https.html:
* Source/WebCore/testing/MockWebAuthenticationConfiguration.h:
* Source/WebCore/testing/MockWebAuthenticationConfiguration.idl:
* Source/WebKit/Shared/WebCoreArgumentCodersAuth.serialization.in:
* Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp:
(WebKit::MockHidConnection::feedReports):
* Source/WebKit/UIProcess/WebAuthentication/fido/CtapHidDriver.cpp:
(WebKit::CtapHidDriver::continueAfterChannelAllocated):
Canonical link: https://commits.webkit.org/318015@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
