21 ms·
Serious Chrome zero-day
- ktjfi 8y agoThe version that includes the fix was released a few days ago... how is this a 0-day at this point?
- smsm42 8y agoI think people who don't know what 0-day actually used to mean use it in a sense of "new security bug". Classically, no 0-day can by definition have a CVE, for example. But right now any new bug which is widely exploitable in the wild can be called in the press "0-day", despite the fix being released.
- arcticfox 8y agoIt was exploited before the vendor was aware; IMO that earns it a permanent "Zero-day" title. Obviously it's not currently a zero-day, given that we're hearing about it from the vendor. The moniker is pretty paradoxical otherwise, the discoverer writing a post about a zero-day would make it no longer a zero-day.
- kbenson 8y agoI always thought it was from the patch date. As I understand it there are 1-days, and 2-days, where people rush to make exploits for released patches to capitalize on the lag time between patch availability and wide deployment (and also zero-days which were recently patched), which is why zero-day denotes that there has been no time since a patch is available (since there isn't one). So, I would say this was a zero-day up until the point Chrome released a patch, and as of now it's some low X-day.
- busterarm 8y agoYou're both wrong for different reasons. 0day refers to vulnerabilities. t0 is when a vulnerability is discovered. t1 is either when the vendor issues a patch OR it is exploited and t2 is when >50% of vulnerable systems have applied the patch. tl;dr: something is 0day once it's discovered. It is no longer 0day once an action is taken with the vulnerability.
- feanaro 8y agoSo it's possible that t1 < t0? Because something might had been exploited before whatever time is taken as the official "discovery date".
- short_sells_poo 8y agoI assume it is 0day irrespective of who discovered it. It remains 0day until an action is taken to mitigate it. So you have 0day exploits being traded on various markets - those are exploits which are known to certain groups, but the affected party hasn't yet taken action to mitigate them (most likely because they don't know).
- deleted 8y ago[deleted]
- tills13 8y agoThe post reads more like an anti-Chrome post than about the exploit.
- kerng 8y agoCurious to learn how long its was exploited before Google noticed.. days, months, years?
- apendleton 8y agoThis is a blog post that seems to just be reporting on this tweet: https://twitter.com/justinschuh/status/1103087046661267456 https://twitter.com/justinschuh/status/1103087046661267456 which in turn is referencing this new release from this past Friday: https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2019/03/stable-channel... which seems to have been motivated by "CVE-2019-5786: Use-after-free in FileReader. Reported by Clement Lecigne of Google's Threat Analysis Group on 2019-02-27". That CVE is still reserved/non-public on the Mitre NVD though.
- deusum 8y agoWell done! That read was unpleasantly verbose.
- saagarjha 8y agoFrom the code referenced, it seems like this might be the commit that fixes this issue: https://github.com/chromium/chromium/commit/ba9748e78ec7e9c0d594e7edf7b2c07ea2a90449 https://github.com/chromium/chromium/commit/ba9748e78ec7e9c0...
- loeg 8y agoIndeed, bug 936448 is a locked bug: https://bugs.chromium.org/p/chromium/issues/detail?id=936448 https://bugs.chromium.org/p/chromium/issues/detail?id=936448
- xfs 8y agoThis interface raw_data_->ToArrayBuffer() sometimes returns a copy of its internal buffer and sometimes returns a smart pointer to its internal buffer. See https://github.com/chromium/chromium/blob/ba9748e78ec7e9c0d594e7edf7b2c07ea2a90449/third_party/blink/renderer/platform/wtf/typed_arrays/array_buffer_builder.h#L63-L67 https://github.com/chromium/chromium/blob/ba9748e78ec7e9c0d5... But DOMArrayBuffer::Create() here takes ownership of the memory from ToArrayBuffer(), so in the latter case of a smart pointer, the internal buffer of raw_data_ is immediately invalidated and its value becomes undefined after creating the DOMArrayBuffer. This is fine if file loading is finished at this point because raw_data_ is reset to nullptr, but if the load is partial, then the undefined value in raw_data_ will be reused to create another DOMArrayBuffer which is then accessible in javascript. Hence the use after free. I'll attribute the root cause of this bug to unclear memory ownership passing in interface design.
- yayr 8y agoWhat does this mean for Electron Apps?
- dleslie 8y agoThey are very likely to be vulnerable.
- eternal_virgin 8y agoElectron Apps are basically already malware
- bezosbaldballs 8y ago> uses up all your resources > is enormous in size for no reason > javascript Ok, agreed.
- AgentME 8y agoIf the Electron app never shows untrusted HTML with Javascript enabled, then it's not an issue. Generally, only Electron apps with arbitrary web browsing functionality would do that.
- nickysielicki 8y agoDo most Electron apps make use of CSP? eg: is it an inherent part of the build process, or is it something that the developer needs to explicitly add?
- cjones26 8y agoWhich is a massive security issue in itself--Electron documentation even warns you about this.
- AgentME 8y agoElectron's docs (https://electronjs.org/docs/tutorial/security#isolation-for-untrusted-content https://electronjs.org/docs/tutorial/security#isolation-for-...) mention that you should webview or BrowserView with a certain option with untrusted content, not that it shouldn't be done at all.
- peterwwillis 8y agoclicks Help->About Google Chrome Updates are disabled by your administrator. welp.
- rosstex 8y agoDon't worry, it's for your safety.
- jedieaston 8y agomaybe your it overlords just send out updates via a patching solution, i doubt they'd be silly enough to run a browser unpatched in 2019. right?
- ocdtrekkie 8y agoI am hoping this is a work PC, because tons of malware use the same setting to prevent Chrome from updating. I see it a lot.
- Thibaut1 8y agoor there might be certain custom extensions work with certain Chrome version
- commandlinefan 8y agoWhat you should do is find out how the referenced vulnerability works and then exploit it to bypass administrator controls so you can update.
- mdaniel 8y agoI hope this doesn't qualify me for a "whoosh" of your joke, but wouldn't an RCE in Chrome run code as the current user? Or did you mean attack the domain admin's computer?
- uniformlyrandom 8y agoThis blog post is so watered down and manages to digress at every possible point that it is almost impossible to read. The only useful part of the text are the URLs. Also, this: > A vulnerability, or vuln for short, is a bug that makes software go wrong in a way that reduces computer security. Does anyone actually use this abbreviation?
- munchbunny 8y agoI do in team chat. It's obvious enough in context, as in "hey can you deploy, I just patched this urgent vuln: [url to ticket]" You won't see me using it in an email or other long form writing though.
- uniformlyrandom 8y agoYep, chat makes sense. Thank you for actually stating a use-case.
- benatkin 8y agoNext time you see a shortened word, you can just assume it's useful. Because they are.
- uniformlyrandom 8y agoNot really, I have seen a lot of unneeded abbreviations. Thankfully we are (almost) out of the age of 140c messages and 40c editor lines. But more to the point, 'vulns' seems like a very unnatural abbreviation. I would go with v11n (similar to i18n).
- warent 8y agov11n meaning vulnerabilitn presumably ;)
- 8y ago
- crushcrashcrush 8y agoHonest question - why do people use Chrome? It’s from an arguably as-evil company as Facebook. Alternatives exist. What’s the draw?
- josefresco 8y agoI use it because my clients use it, and their customers use it, which means my client's website has to look and work perfectly in it. I also use Firefox on my second monitor, because it's my preferred browser.
- saagarjha 8y agoIt's simple, familiar, and works on all their devices?
- JohnJamesRambo 8y agoI used it because it was fast, now I use Brave and it is fast and private.
- crispyporkbites 8y agoHow do you know if someone uses Brave? ... They'll tell you!
- bepvte 8y agoActually, you can tell because of the referrer http headers brave injects for websites that pay brave
- lapnitnelav 8y agoWhat do you mean by websites that pay Brave? Isn't that supposed to be the other way around? -- That's a serious question btw.
- freeopinion 8y agoAnd still vulnerable to this?
- paulpauper 8y agoThis write-up is not helpful and says nothing about how one would be infected. it just says it can do code execution but no evidence anyone has been infected in any way or how would would be infected. The worst 0day possible is un-sandboxed code execution that is activated by merely visiting a webpage or clickinig.
- bestnameever 8y agoIt was helpful enough for me to look for more information. https://twitter.com/justinschuh/status/1103087046661267456 https://twitter.com/justinschuh/status/1103087046661267456
- jrochkind1 8y agoThis article has a bit more information, including suggestions by some that there are indeed exploits active in the wild. https://www.forbes.com/sites/daveywinder/2019/03/07/google-confirms-serious-chrome-security-problem-heres-how-to-fix-it/#f30ea7820029 https://www.forbes.com/sites/daveywinder/2019/03/07/google-c... > Although information regarding CVE-2019-5786 remains scarce currently, Satnam Narang, a senior research engineer at Tenable, says it is a "Use-After-Free (UAF) vulnerability in FileReader, an application programming interface (API) included in browsers to allow web applications to read the contents of files stored on a user's computer." Some further digging by Catalin Cimpanu over at ZDNet suggests that there are malicious PDF files in the wild that are being used to exploit this vulnerability. "The PDF documents would contact a remote domain with information on the users' device --such as IP address, OS version, Chrome version, and the path of the PDF file on the user's computer" Cimpanu says. These could just be used for tracking purposes, but there is also the potential for more malicious behavior. The 'use-after-free' vulnerability is a memory corruption flaw that carries the risk of escalated privileges on a machine where a threat actor has modified data in memory through exploiting it.
- zenexer 8y agoThat's conflating two unrelated issues. The issue reported by EdgeSpot is much less severe, and a Google engineer hinted that it may not even be a vulnerability. CVE-2019-5786 has nothing to do with PDF files.
- staticassertion 8y agoI'll be that guy. Chrome has probably invested > 1 billion dollars into their codebase at this point. Certainly >100million into security. They sandbox their code aggressively. They build this project with security in mind from day 1 - it's been architected for it. The Chrome security team(s) has a lot of power for a product security org. They fuzz. They invent new fuzzers. They cluster their fuzzers. They have a world class bounty program. They have a world class research team for finding vulns. They invent or otherwise aggressively adopt mitigation techniques. But someone out there did it. Their track record for security is something to really be proud of - this is the first public ITW exploit of its type that I am aware of. But users are getting owned because of, at the very least, a Use After Free vulnerability. Let's just collectively admit it, finally - you can't write safe C++ in a codebase this complex. edit: (From a post below) To be clear, I'm not saying "Chrome should be rewritten in a memory safe language", I'm saying that Chrome is an excellent project to point to, say "Wow, no one does as much to secure a codebase as them", and to follow that up with "and they still got owned by UAF".
- elorant 8y agoSo what language should they've written it in?
- deleted 8y ago[deleted]
- staticassertion 8y agoA memory safe one. There are many of them. They could build their own if they chose to - they've built multiple languages in the past. Picking a language for the Chrome team doesn't seem practical - we all know where your question is going to head. The point is they have to not pick C++. Again, they've invested many, many millions of dollars into security. Let's not pretend that they're priced out of using another language.
- gpm 8y agoIt doesn't even have to be memory safe, just less memory accident prone. D for example would have been an interesting choice (and I think it was usable back then).
- aboutruby 8y agoTLDR: 72.0.3626.121 is the version you are looking for
- yrro 8y agoThanks!
- MikeHolman 8y agoThis looks bad for Google. EdgeSpot detected an in-the-wild exploit and told Google about this in December, but Google wasn't going to fix the bug until late April. Google only released a patch early because the finder blogged about it. https://blog.edgespot.io/2019/02/edgespot-detects-pdf-zero-day-samples.html https://blog.edgespot.io/2019/02/edgespot-detects-pdf-zero-d...
- deleted 8y ago[deleted]
- lima 8y agoThat's an entirely different vulnerability.
- sterlind 8y agoYeah, I was going to say... it would make zero sense for an attacker to waste a Chrome RCE 0day on tracking people who read academic books about Honduras! Although, I'm not sure why they'd do that in the first place, even. Anti-piracy? Seems a lot of effort..
- entropie 8y agoHmm. Is the developer version affected too? Iam running Version 74.0.3717.0 (Official Build) dev (64-bit) compiled at march 5. (gentoo). Looking for an update in portage right now.
- entropie 8y agoThere was actually an update in portage available, running now Version 74.0.3724.8 (Official Build) dev (64-bit)
- k_sze 8y agoI have a hard time believing that something written on sophos.com can be so click-baity/devoid of substance. Half of it is vulnerability vs exploit in eli5 style, and then the rest is just mentioning FileReader in passing.
- MichailP 8y agoIs Canary build safe? My version is 74.0.3726.0 (Official Build) canary (64-bit)?
- mnm1 8y agoHuh? Right now, my Chrome says: Google Chrome is up to date Version 66.0.3359.117 (Official Build) (64-bit) Automatic updates are turned on Learn more I guess it's time to just delete this garbage, but I'm wondering why. Clearly there are serious issues with Chrome on OS X.
- lemoncucumber 8y ago> A vulnerability, or vuln for short, is a bug that makes software go wrong in a way that reduces computer security. So glad the article cleared that up.
- outside1234 8y agoGlad Google released this as part of their Google Zero project. Oh wait, they didn't. That's only for other people's bugs.
- chrononaut 8y agoThere goes 1.5 million dollars in someone's money.[0] [0] https://motherboard.vice.com/en_us/article/pax987/crowdfense-offers-3-million-for-iphone-android-hacks https://motherboard.vice.com/en_us/article/pax987/crowdfense...
- dplgk 8y ago> Like, seriously, update your Chrome installs… like right this minute. If so serious, remove the 2 likes from the sentence.
- javajosh 8y agoUpdating Chrome is a vaccination, which is great, but people already affected by this exploit need a cure. I'd like to know more about who was exploiting this and for what purpose, and how to undo it.
- runn1ng 8y agoWhy is this blogspam with no information upvoted in the first place? Does anyone enjoy reading this?
- IloveHN84 8y agoSeriously, remove the power given to developers to exploit JavaScript in every kind of exotic mode and you'll have zero bugs.
- GrryDucape 8y agoThe vulnerability is in the browser’s code itself. If you have the stable channel for Chrome added into Linux, then you just have to run ‘sudo dnf update.’
- Rapzid 8y agoOh man.. Am I the only person who has been neglecting that little red arrow icon in Chrome for the past few days?! I'll take some blame, but it would be great if Chrome popped up a blocking message that said "UPDATE NOW, DAY ZERO IS UPON THEE!!!!"
- Wyndtroy2012 8y agoJust quit and restart Chrome. No need to fight with an link you can’t click.
- Griceraae50100 8y agoNote that you can also upgrade Google Chrome by going to he 3 vertical dots menu, Help -> About Google Chrome. I reckon that’s a little less scary for inexperienced users than typing in an arcane URL into the address bar…
- llacb47 8y agoDarn, now I have to update chromium and get the new tab design. I've been avoiding it for a while.
- FerosMorgen 8y agoThis is why you don’t run TV ads stating you’re completely immune to viruses.
- timkofu 8y agoRust anyone?