Google has updated its Chrome web browser, fixing 4 bugs with a severity rating of “high” and 8 overall. 3 are use-after-free flaws, which could allow an adversary to create an error in the browser’s memory, opening the door to a browser hack & host computer compromise.
Desktop versions of the browser received a total of 8 fixes, half rated ‘high-severity.’
CISA
On Fri., the US Cybersecurity & Infrastructure Security Agency (CISA) issued a security bulletin asking users & infosec administrators to apply the update. The agency warned that the vulnerabilities can be used by an attacker “to take control of an affected system.”
According to Google’s Dec. security bulletin, previous Windows, macOS & Linux versions of the Chrome desktop browser are vulnerable to attacks. An updated 87.0.4280.88 version of Chrome addresses the bugs & will “roll out over the coming days/weeks,” Google wrote.
Manually Update of Your Chrome Browser
To manually update your Chrome browser, visit Chrome’s customisation drop-down menu in the upper-right hand side of the client. From that menu select “Help” & then “About Google Chrome.” Opening that menu item automatically triggers Chrome to look for updates.
Details linked to each of the bugs are being withheld at this time, Google explained, “until a majority of users are updated with a fix.” It also noted that when & if bugs exist in 3rd-party code libraries used in other devices or platforms, technical details of the bugs will be restricted.
Unique Linux Flaw
3 high-severity bugs each include use-after-free elements impacting memory, tied to Chrome’s clipboard, media & extensions components. The bugs are tracked as CVE-2020-16037, CVE-2020-16038 and CVE-2020-16039.
The 4th high-severity bug (CVE-2020-16040) impacts Google’s open-source and high-performance JavaScript & Web Assembly engine, called V8. The bug is identified as an insufficient-data-validation flaw, which in some cases opens targets to cross-site scripting attacks.
JavaScript
Google’s V8 JavaScript engine also received a 2nd patch this month — 1 of 2 medium-severity bugs reported this Dec. Tracked as CVE-2020-16042, that issue is identified as an “un-initialised-use” bug impacting V8. It is unclear from Google’s bulletin the exact nature of the flaw.
However, cyber-security researchers have described these types of un-initialised-use bugs as “largely overlooked” & often “regarded as insignificant memory errors.”
“These are actually a critical attack vector that can be reliably exploited by hackers to launch privilege-escalation attacks in the Linux kernel,” outlines 2017 research published by the Georgia Institute of Technology.
Vulnerability
A 2nd medium-severity bug (CVE-2020-16041) is an “out-of-bounds read in networking” vulnerability. This could let an adversary improperly access objects in memory.
Technical details of the CVE are also being withheld, but this type of vulnerability could allow an unauthenticated adversary to send a malformed message to vulnerable software. Due to insufficient validation of the message, the targeted program could be forced to crash.
Researchers
Google acknowledged several security researchers that contributed to identifying this month’s bugs.
Ryoya Tsukasaki was thanked for finding the use-after-free bug (CVE-2020-16037) in the Chrome clipboard, which earned the researcher a $5,000 bug bounty. Khalil Zhani, Lucas Pinheiro, Sergei Glazunov, André Bargull & Mark Brand were also credited for their bug-hunting.
https://www.cybernewsgroup.co.uk/virtual-conference-january-2021/
