CVE-2019-13720: Use-After-Free Zero Day in Google Chrome Exploited in the Wild
Though details are scant, Google released a patch for a Google Chrome vulnerability that has been exploited in the wild as a zero day.
Background
On October 31, Google published a Stable Channel Update for the desktop version of Google Chrome. This release fixes two vulnerabilities, one of which has been exploited in the wild as a zero day.
Analisi
CVE-2019-13720 is a use-after-free (UAF) vulnerability in audio for Google Chrome. It is unclear if the audio component referenced here is associated with content in the media/audio source. The flaw was reported to Google on October 29 by Kaspersky Lab researcher Alexey Kulaev and Anton Ivanov, Head of Advanced Threats Research and Detection. According to Kaspersky, the vulnerability was observed being exploited in the wild as a zero day.
A few days ago our technologies caught a new Chrome 0day exploit used in the wild and we reported it to Google. Just released-Chrome 78 patches it, credits to my colleagues @antonivanovm and Alexey Kulaev for finding the bug. https://t.co/Bgm0QtNO2d
— Costin Raiu (@craiu) November 1, 2019
Additional details about the flaw are restricted from the public, likely in an effort to give users and organizations time to apply patches. However, Kaspersky published some details on their blog, linking the vulnerability to an attack campaign called Operation WizardOpium.
In their blog, Kaspersky researchers identified the vulnerability by following malicious code injection on a Korean-language news portal. Due to “vulnerability disclosure principles,” Kaspersky has not disclosed specific details about the vulnerability itself. However, they do note the exploit “used a race condition bug between two threads due to missing proper synchronization between them.” This race condition results in the UAF that could lead to arbitrary code execution, which Kaspersky says “happens in our case.”
The other vulnerability patched in this Google Chrome for Desktop release is CVE-2019-13721, a UAF vulnerability in the PDFium library reported on October 12 by security researcher banananapenguin.
CVE-2019-13720 is the second UAF vulnerability in the audio component that has been patched in Google Chrome this month. On October 10, CVE-2019-13695, another audio UAF flaw, reported by Man Yue Mo of the Semmle Security Research Team was patched.
Proof of concept
At the time this blog was published, no proof of concept (PoC) for CVE-2019-13720 was available. However, Google acknowledges “an exploit” for the vulnerability “exists in the wild.”
Solution
Google addressed CVE-2019-13720 and CVE-2019-13721 in Google Chrome 78.0.3904.87 for Windows, Mac and Linux. Google notes the patched version will “roll out over the coming days/weeks,” according to the Security Advisory.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released. Additionally, Kaspersky provided indicators of compromise in their blog, which can also be used to identify systems affected by this operation.
Get more information
- Google Chrome Stable Channel Update (78.0.3904.87)
- Google Stable Channel Update Addressing CVE-2019-13695
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 60-day trial of Tenable.io Vulnerability Management.
Articoli correlati
CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
August 14, 2024Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available
CVE-2024-20419: Cisco Smart Software Manager On-Prem Password Change Vulnerability
August 9, 2024Critical vulnerability in Cisco Smart Software Manager On-Prem exposes systems to unauthorized password changes, exploit code now available.BackgroundOn July 17, 2024, Cisco published an advisory for ...
Detecting Risky Third-party Drivers on Windows Assets
August 7, 2024Kernel-mode drivers are critical yet risky components of the Windows operating system. Learn about their functionality, the dangers they pose, and how Tenable's new plugins can help identify and mitigate vulnerabilities using community-driven resources like LOLDrivers.
Cybersecurity Snapshot: Guide Unpacks Event-Logging Best Practices, as FAA Proposes Stronger Cyber Rules for Airplanes
August 23, 2024Looking to sharpen your team’s event logging and threat detection? A new guide offers plenty of best practices. Plus, the FAA wants airplanes to be more resilient to cyberattacks. Meanwhile, check out the critical vulnerabilities Tenable discovered in two Microsoft AI products. And get the latest on ransomware trends, vulnerability management practices and election security!
SSRFing the Web with the Help of Copilot Studio
August 20, 2024Tenable Research discovered a critical information-disclosure vulnerability in Microsoft’s Copilot Studio via a server-side request forgery (SSRF), which allowed researchers access to potentially sensitive information regarding service internals with potential cross-tenant impact.
Cybersecurity Snapshot: First Quantum-resistant Algorithms Ready for Use, While New AI Risks’ Database Is Unveiled
August 16, 2024NIST has released the first encryption algorithms that can protect data against quantum attacks. Plus, MIT launched a new database of AI risks. Meanwhile, the CSA published a paper outlining the unique risks involved in building systems that use LLMs. And get the latest on Q2’s most prevalent malware, the Radar/Dispossessor ransomware gang and CVE severity assessments!
- Vulnerability Management