CVE-2019-13720：Use-After-Free Zero Day in Google Chrome Exploited in the Wild
Though details are scant, Google released a patch for a Google Chrome vulnerability that has been exploited in the wild as a zero day.
背景說明
On October 31, Google published a Stable Channel Update for the desktop version of Google Chrome. This release fixes two vulnerabilities, one of which has been exploited in the wild as a zero day.
分析
CVE-2019-13720 is a use-after-free (UAF) vulnerability in audio for Google Chrome. It is unclear if the audio component referenced here is associated with content in the media/audio source. The flaw was reported to Google on October 29 by Kaspersky Lab researcher Alexey Kulaev and Anton Ivanov, Head of Advanced Threats Research and Detection. According to Kaspersky, the vulnerability was observed being exploited in the wild as a zero day.
A few days ago our technologies caught a new Chrome 0day exploit used in the wild and we reported it to Google. Just released-Chrome 78 patches it, credits to my colleagues @antonivanovm and Alexey Kulaev for finding the bug. https://t.co/Bgm0QtNO2d
— Costin Raiu (@craiu) November 1, 2019
Additional details about the flaw are restricted from the public, likely in an effort to give users and organizations time to apply patches. However, Kaspersky published some details on their blog, linking the vulnerability to an attack campaign called Operation WizardOpium.
In their blog, Kaspersky researchers identified the vulnerability by following malicious code injection on a Korean-language news portal. Due to “vulnerability disclosure principles,” Kaspersky has not disclosed specific details about the vulnerability itself. However, they do note the exploit “used a race condition bug between two threads due to missing proper synchronization between them.” This race condition results in the UAF that could lead to arbitrary code execution, which Kaspersky says “happens in our case.”
The other vulnerability patched in this Google Chrome for Desktop release is CVE-2019-13721, a UAF vulnerability in the PDFium library reported on October 12 by security researcher banananapenguin.
CVE-2019-13720 is the second UAF vulnerability in the audio component that has been patched in Google Chrome this month. On October 10, CVE-2019-13695, another audio UAF flaw, reported by Man Yue Mo of the Semmle Security Research Team was patched.
概念驗證
At the time this blog was published, no proof of concept (PoC) for CVE-2019-13720 was available. However, Google acknowledges “an exploit” for the vulnerability “exists in the wild.”
解決方法
Google addressed CVE-2019-13720 and CVE-2019-13721 in Google Chrome 78.0.3904.87 for Windows, Mac and Linux. Google notes the patched version will “roll out over the coming days/weeks,” according to the Security Advisory.
找出受影響的系統
A list of Tenable plugins to identify this vulnerability will appear here as they’re released. Additionally, Kaspersky provided indicators of compromise in their blog, which can also be used to identify systems affected by this operation.
取得更多資訊
- Google Chrome Stable Channel Update (78.0.3904.87)
- Google Stable Channel Update Addressing CVE-2019-13695
加入 Tenable Community 的 Tenable 安全回應團隊。
深入瞭解 Tenable，這是用於全面管理新型攻擊破綻的首創 Cyber Exposure 平台。
Get a free 60-day trial of Tenable.io Vulnerability Management.
相關文章
CVE-2024-21793, CVE-2024-26026: Proof of Concept Available for F5 BIG-IP Next Central Manager Vulnerabilities
May 9, 2024Researchers disclose multiple vulnerabilities in F5 BIG-IP Next Central Manager and provide proof-of-concept exploit code, which could lead to exposure of hashed passwords.
Cybersecurity Snapshot: Attackers Pounce on Unpatched Vulns, DBIR Says, as Critical Infrastructure Orgs Benefit from CISA’s Alert Program
May 3, 2024Verizon’s DBIR found that hackers are having a field day exploiting vulnerabilities to gain initial access. Plus, a CISA program is helping critical infrastructure organizations prevent ransomware attacks. In addition, check out what Tenable’s got planned for RSA Conference 2024. And get the latest on the Change Healthcare breach. And much more!
CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor
April 25, 2024Frequently asked questions about CVE-2024-20353 and CVE-2024-20359, two vulnerabilities associated with “ArcaneDoor,” the espionage-related campaign targeting Cisco Adaptive Security Appliances.
Cybersecurity Snapshot: New Guide Explains How To Assess if Software Is Secure by Design, While NIST Publishes GenAI Risk Framework
May 10, 2024Is the software your company wants to buy securely designed? A new guide outlines how you can find out. Meanwhile, a new NIST framework can help you assess your GenAI systems’ risks. Plus, a survey shows a big disconnect between AI usage (high) and AI governance (low). And MITRE’s breach post-mortem brims with insights and actionable tips. And much more!
CVE-2024-21793, CVE-2024-26026: Proof of Concept Available for F5 BIG-IP Next Central Manager Vulnerabilities
May 9, 2024Researchers disclose multiple vulnerabilities in F5 BIG-IP Next Central Manager and provide proof-of-concept exploit code, which could lead to exposure of hashed passwords.
Cybersecurity Snapshot: Attackers Pounce on Unpatched Vulns, DBIR Says, as Critical Infrastructure Orgs Benefit from CISA’s Alert Program
May 3, 2024Verizon’s DBIR found that hackers are having a field day exploiting vulnerabilities to gain initial access. Plus, a CISA program is helping critical infrastructure organizations prevent ransomware attacks. In addition, check out what Tenable’s got planned for RSA Conference 2024. And get the latest on the Change Healthcare breach. And much more!
- Vulnerability Management