[12] MTE Hardening: CompactRefPtrTuple Stale Pointer Zeroing

Severity: Medium | Component: WTF CompactRefPtrTuple | 98bb748

Rated Medium because this is a mitigation weakness rather than a standalone vulnerability — stale compact pointer data surviving destruction creates an MTE bypass vector for attackers who already have a separate UAF primitive, but the CompactRefPtrTuple's role in MTE bypass is inferred from the commit message rather than demonstrated with a concrete exploit chain. Confidence is 0.62.

Patch Details

Adds secureZeroBytes(m_data) in the destructor of CompactRefPtrTuple, immediately after the existing derefIfNotNull call.

Source/WTF/wtf/CompactRefPtrTuple.h

Stale pointer data surviving destruction in a type exempt from hardware memory tagging, creating an MTE bypass vector.

Background

ARM MTE (Memory Tagging Extension) assigns 4-bit tags to memory granules and pointer values; accessing memory with a mismatched tag triggers a hardware fault, catching use-after-free and out-of-bounds accesses. Compact pointers in WebKit use pointer compression — stripping or repurposing upper bits of the pointer — to save memory. This encoding is incompatible with MTE tagging because MTE stores its tag in the same upper bits that compact pointer compression uses. secureZeroBytes is a WebKit utility that zeroes memory in a way that cannot be optimized away by the compiler (unlike a plain memset which a compiler may elide for dead stores in destructors).

Analysis

Before the fix, CompactRefPtrTuple's destructor decremented the reference count of the held pointer but did not zero the m_data storage. Since compact pointers cannot be tagged by ARM MTE — they use pointer compression that strips or repurposes the top bits where MTE tags reside (as stated in the commit message) — a stale compact pointer left in freed and reallocated memory would not trigger an MTE tag mismatch on access. An attacker who could reclaim the freed memory containing a CompactRefPtrTuple (e.g., a ThreadTimerHeapItem, as the commit message references) would find a valid-looking pointer value in the reclaimed slot, bypassing MTE's use-after-free detection for that pointer.

Audit directions