High
CVE-2022-2294
CVE-2022-2294
Description
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Add Assessment
Technical Analysis
Looks like this was a heap buffer overflow in WebRTC which could allow for a drive by attack that would grant attackers RCE on a target system. No news as to whether or not this was used with a sandbox escape though, It was reported by Jan Vojtesek from the Avast Threat Intelligence team on 2022-07-01 according to https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html, yet interestingly https://chromereleases.googleblog.com/2022/07/chrome-for-android-update.html also note it affects Chrome for Android.
There is a real world exploit for this out in the wild but given the generally tight lipped news around this and that it was found from a threat intelligence team, I would imagine this may have been used in more targeted attacks, but still widely enough that a threat intelligence team picked up on it. Bit hard to tell though since I hadn’t heard about the Avast Threat Intelligence team prior to this; I imagine its possible one of their customers was targeted selectively and then they found out and notified Google.
With heap overflow bugs I generally err on the side of “well these things are harder to exploit” however with browsers you typically have access to a much wider arsenal to use for crafting the heap into a state that is desirable for exploitation purposes, so the risk is a bit higher here. That being said exploitation of such bugs tends to be a little more complex in most cases, particularly given recent mitigations. I’d still recommend patching this one if you can, but if not then you should try to disable WebRTC on your browsers until you can patch given in the wild exploitation.
CVSS V3 Severity and Metrics
General Information
Vendors
- apple,
- fedoraproject,
- google,
- webkitgtk,
- webrtc project,
- wpewebkit
Products
- chrome,
- extra packages for enterprise linux 8.0,
- fedora 35,
- fedora 36,
- ipados,
- iphone os,
- mac os x,
- mac os x 10.15.7,
- macos,
- tvos,
- watchos,
- webkitgtk,
- webrtc -,
- wpe webkit
Exploited in the Wild
References
Advisory
Excellent analysis. Thank you