10 ms·

Chrome 0day is being exploited now for CVE-2022-1096; update immediately

• fn-mote 4y ago
  I use snap for some applications in spite of the trouble it has caused me. I was super-happy to find out that it had upgraded me to a not-vulnerable verson of chromium before I even knew to look. For all of the (deserved) hate snap gets, there are some shining up sides.
  • the_common_man 4y ago
    I use apt and it didn't update to this vulnerable version in the first place, so there's that
    • nieve 4y ago
      Do we know for sure the vulnerability was only in that version?
• suigetsusake 4y ago
  It looks like this impacts all chromium-based browsers [0] which might not be obvious (was not for me anyway) [0] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-1096 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
• t3odump 4y ago
  I would like to analyze the issue of browser security without controversy. The mitigations that Edge puts into practice (I'm talking about "Super Duper Secure" and "Enhanced Security") can prevent the operation of exploits in the V8 engine like this 0-day? Is this platform dependent or the mitigation in progress works well? I mean for example some feature on mac and Linux is available out of the box asACG feature. This analysis is very interesting because I have only read analisys related to privacy and not about security and integrity. (I mean compare between Chorme, Edge, Brave, etc ...)
• _Nat_ 4y ago
  > Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days.
  • flotzam 4y ago
    Maybe JIT-less V8: https://v8.dev/blog/jitless https://v8.dev/blog/jitless
  • azornathogron 4y ago
    If you're worried about browser vulnerabilities in the javascript engine, have you considered disabling javascript by default and enabling it per-site on just the sites that you trust?
    • _Nat_ 4y ago
      Yup, that's the current strategy. However, I'd prefer to have a secure JavaScript-engine that could be kept on by default, then enable a fast JavaScript-engine on a per-site basis. For example, I have an exception on here for HackerNews to use JavaScript. But the JavaScript HackerNews uses is trivial; a naive JavaScript engine that's 1000x slower and uses 100x the RAM probably wouldn't even make an observable difference, would it? Except if it's secure, then I could've just had JavaScript on by default (without needing to add an exception), and then I wouldn't have to worry about stuff like if HackerNews gets compromised one day. A lot of sites seem to do really little things with JavaScript, but break if it's disabled -- some blog sites won't even load posts without JavaScript enabled. It'd be nice to just have a secure browser to view such things with.
  • azornathogron 4y ago
    There are certainly other javascript implementations. For example, here's one I stumbled upon recently that's written in plain Go: https://github.com/dop251/goja https://github.com/dop251/goja Of course, it won't help you since it's not built into a web browser.
• baq 4y ago
  Just what the doctor ordered in the middle of a war which is also waged in the information space. Hopefully the fact that it’s in v8 will take the exploit a bit longer than usual to proliferate.
  • draw_down 4y ago
• mdb31 4y ago
  Chromium-based versions of Microsoft Edge are also vulnerable: updating to 99.0.1150.55 fixes this CVE
• paulpauper 4y ago
  this just goes to show that updates are always 2 or so steps behind. It's a near certainty that governments, top criminal organizations have a trove of exploits for all major programs, and new ones created after old ones get patched.
• buro9 4y ago
  Type confusion in V8... May well impact Cloudflare workers too.
  • dknecht 4y ago
    We have already tested and global rollout started earlier today.
  • stjohnswarts 4y ago
    Yeah wondering if this also a 0 day for node.js and electron apps...
    • kentonv 4y ago
      This is a 0 day for anything that uses V8 to execute possibly-malicious JavaScript. Node.js and Electron aren't designed to do that in the first place, so this doesn't really affect them.
      • ComradePhil 4y ago
        Unless some protestware decides to delete all your data and replace everything with "icri4ukraine".
        • kentonv 4y ago
          That's the thing... It can already do that without a V8 vulnerability.
• octoberfranklin 4y ago
  When the web "standards" are so insanely complicated that even Google can't implement them securely, it's time to admit that we have a problem. When there is only one other complete implementation of these "standards" (with miniscule market share), it's time to panic.
  • bawolff 4y ago
    There is no indication yet that this is due to complex web standards. It could be, but we literally dont know what the bug is yet.
    • hdjjhhvvhga 4y ago
      But we do know that it is Javascript-related, so please correct me if I'm wrong but disabling JS for all websites except the ones you really, really trust and need should offer long-term general protection against such 0-days in most cases.
      • bawolff 4y ago
        It certainly reduces attack surface. JIT based js engines do seem like a big attack surface, although certainly not the only one. I'm not sure i would call js part of "complex new web standards". In its original form it was introduced way back in 1995.
      • paxys 4y ago
        There are lots of 0day exploits outside of the JavaScript engine. Going down this path, it would be safest to not use the web at all, or really just not own a computer.
        • hdjjhhvvhga 4y ago
          No, I think it's reductio ad absurdum; what I mean is reasonable means of reducing risks for people who don't use that much web apps and consume mostly text such as news etc.
        • 4y ago
• tommiegannert 4y ago
  Looks like 99.0.4844.84 is the release we want. https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html https://chromereleases.googleblog.com/2022/03/stable-channel...
  • metadat 4y ago
    It's definitely not yet out for Android. On my device the version is stuck at: 99.0.4844.73
    • lern_too_spel 4y ago
      I have 99.0.4844.88, updated yesterday. The release notes for Android don't mention the CVE. https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html https://chromereleases.googleblog.com/2022/03/stable-channel...
      • metadat 4y ago
        I just checked the play store and there was indeed a pending update for chrome. Now at .88. Until the next C++VE, cheers!
  • techolic 4y ago
    I just upgraded to this and noticed the Reading List has changed design again! They must have gone back and forth thousands of times on this so hopefully this is the final version.
  • rikroots 4y ago
    Release 99.0.4844.84 has borked my JS canvas library. Currently working on a fix - it was my misunderstanding of the purpose of the CanvasAPI willReadFrequently flag that left the library open to a severe speed degradation. In my defence the documentation implies that the willReadFrequently flag is only a hint to the browser, to take a different approach when performing getImageData() operations[1]. However setting the flag to true also impacts drawImage() functionality[2]. I tried reporting the issue as a bug last night - at the very least the issue needs to be documented - but the form for reporting issues kept collapsing on me so I gave up. [1] - https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasElement/getContext https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasE... [2] - minimum demo of issue - https://codepen.io/kaliedarik/pen/bGaqMVj https://codepen.io/kaliedarik/pen/bGaqMVj
• amelius 4y ago
  Is Electron at risk too?
  • scambier 4y ago
    If your Electron app executes third party, remote code. But if it does, you should definitely not use it.
    • gruez 4y ago
      >If your Electron app executes third party, remote code. There's a high chance that it does because of embedded content/ads/iframes/in-app browsers.
      • mr_toad 4y ago
        Which electron apps have embedded ads running third party JavaScript? That’s a huge security risk.
      • kentonv 4y ago
        Are in-app browsers in Electron even secure in the first place? Does it use Chrome-style sandboxing with multiple processes, etc.? Do bugs in the Electron engine get patched in a timely fashion? Genuinely asking here. I've never written an Electron app personally so I don't know how this stuff is done exactly, but the idea of in-app browsers in Electron apps sounds terrifying to me, security-wise.
        • mwcampbell 4y ago
          Electron has been moving toward security by default in renderer processes, but Chromium sandboxing isn't yet enabled by default in these processes. More here: https://www.electronjs.org/docs/latest/tutorial/sandbox https://www.electronjs.org/docs/latest/tutorial/sandbox
  • neoneye2 4y ago
    Visual Studio Code is built with Electron. VSCode has lots of extensions available. Can a VSCode extension exploit this 0day?
• johndfsgdgdfg 4y ago
  • ptk 4y ago
    I don’t know if you’re joking or not, and I say this as someone who uses Edge as their primary browser, but Edge does not improve the situation you describe. Edge is just a flavor of chromium at this point and absolutely gives Chrome a run for its money in the tracking and telemetry department.
  • hungryforcodes 4y ago
    Windows 10 is definitely spyware. So migrating to Edge is hardly a solution. Chromium on the other hand...
  • aceBacker 4y ago
    Heh, my corp locks down the edge updates and bundles them with the OS updates. Edge is going to be vulnerable to this one for months maybe a year longer that chrome.
    • mr_toad 4y ago
      Where I work they lock down Chrome updates as well.
• gruez 4y ago
  Is there a site/service/mailing list that provides notifications for critical/RCE/in-the-wild exploit patches? Keeping every piece of software you run up-to-date takes a lot of work, and something like that would help with knowing what to prioritize.
  • lcall 4y ago
    I subscribe to debian and openbsd security advisory email lists, which works for me generally to know what is going on in the space(s) I care more about: https://lists.debian.org/debian-security-announce/ https://lists.debian.org/debian-security-announce/ (this one covers security updates to many packages, but not as much as CVE advisories cover, windows, etc) https://www.debian.org/security/ https://www.debian.org/security/ https://www.openbsd.org/mail.html https://www.openbsd.org/mail.html (ctrl-f for security, but unlike the debian ones, this only covers patches to the base OS, not other packages). But for you of course it would depend on what you run and what matters to you.
  • cors-fls 4y ago
    Yes ! Computer Emergency Response Teams (CERT)[1] exist in most countries and publish security advisories as newsletters or RSS. e.g. CERT-EU security advisories [2] But there are so many softwares and exploits that the signal to noise ratio is low if you are not in charge of a big IT infra. [1] https://en.m.wikipedia.org/wiki/Computer_emergency_response_team https://en.m.wikipedia.org/wiki/Computer_emergency_response_... [2] https://cert.europa.eu/cert/newsletter/en/latest_SecurityBulletins_.html https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul...
    • gruez 4y ago
      >[2] https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul... I took a look and my first impressions are not good. 1. like you mentioned, the signal to noise ratio is pretty bad. eg. "OpenSSL/LibreSSL Vulnerability (CERT-EU Security Advisory 2022-017)" which is a DoS exploit that consumers would likely not care about. There's also no vendor/product filter, so I get notifications about "H2 Database Console" that I don't care about. 2. It's slow/out of date. eg. "Multiple Vulnerabilities in VMware (CERT-EU Security Advisory 2022-013)" was published on February 17, 2022, but the patch was published January 15th, a month earlier.
• janci 4y ago
  Is Chrome for android affected? And V8 in nodejs?
• _8j50 4y ago
  Is there a public exploit for this? Working on detecting browser exploitation myself.
  • throwaway684936 4y ago
    I believe more details are usually published after most people are given a chance to update.
  • ineedasername 4y ago
    If you mean in-the-wild, then yes: https://securityboulevard.com/2022/03/google-chrome-cve-2022-1096-emergency-patch/ https://securityboulevard.com/2022/03/google-chrome-cve-2022...
  • baby 4y ago
    Let's give people a chance to update before spreading these please
• ruuda 4y ago
  Type confusion in V8 ... Fortunately I turned off javascript by default since Meltdown/Spectre.
  • dijit 4y ago
    I did the same. But the web is basically unusable for me now and devs seem unsympathetic.
• TT-392 4y ago
  Anyone know if qutebrowser is affected?
  • The-Compiler 4y ago
    See https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebrowser_affected_by_cve20221096/ https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebro... - it seems to be, unfortunately.
  • dijit 4y ago
    Yes
  • creata 4y ago
    Why wouldn't it be? It uses Chromium (via QtWebEngine) by default.
    • stjohnswarts 4y ago
      because qtwebengine isn't updated nearly as often and this appear to be a recent bug not a long running one.
      • creata 4y ago
        Thanks, I didn't think about that.
        • stjohnswarts 4y ago
          I'm not saying it -isn't- in there, just that it's not 100% chance it's there. I don't think the exact "failure" has been cited yet. Would be good to check qute-browser webpage or qtwebengine page rather than a random HN asshole like me :D
          • The-Compiler 4y ago
            See https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebrowser_affected_by_cve20221096/ https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebro... - it seems to be, unfortunately.
• ainar-g 4y ago
  Looks like these are the two commits, based on the issue number: https://github.com/v8/v8/commit/0981e91a4f8692af337e2588562ad1504f4bffdc https://github.com/v8/v8/commit/0981e91a4f8692af337e2588562a... https://github.com/v8/v8/commit/a2cae2180a7a6d64ccdede44d730c9fbba690fb7 https://github.com/v8/v8/commit/a2cae2180a7a6d64ccdede44d730... Although there could be others.
  • menomatter 4y ago
    From those commits, would you say this is RCE vulnerability taking advantage of memory/stack callbacks? Does this mean an attacker may exploit this vulnerability to compromise an entire system?
  • kerneloops 4y ago
  • emerged 4y ago
    Interesting, I’ve never seen the “maybe_db” style of variable naming. Makes sense but looks weird.
• nathants 4y ago
  securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is. an exploit that cannot communicate is likely benign and easy to detect in the attempt. monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. macos has littlesnitch[1], linux has opensnitch[2], or roll your own on libnetfilterqueue[3]. bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering. bonus points if the filtering is at executable level granularity instead of system level. 1. https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html 2. https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch 3. https://github.com/nathants/tinysnitch https://github.com/nathants/tinysnitch
  • figglestar 4y ago
    > monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. > bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering. Is it possible to combine these two with open/tinysnitch somehow? It'd be nice to easily build a whitelist but with the way Windows works I couldn't trust any firewall that was running on Windows itself.
    • nathants 4y ago
      filtering upstream is easy, just send all traffic to a linux wireguard server and run a snitch there. getting the gui prompt is a bit tricker. for maximum trust, that gui should probably be on another device than the original machine. ie a push notification to your phone.
• eezurr 4y ago
  Anyone know if this affects Vivaldi? I assume it does since it's chromium based, but there isn't an update available.
  • djokkataja 4y ago
    There's an update for the desktop browser: https://vivaldi.com/blog/desktop/minor-update-five-5-1/ https://vivaldi.com/blog/desktop/minor-update-five-5-1/
• bArray 4y ago
  Just added a bug for the Ubuntu Chromium dev PPA to update their packages: https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bug/1966572 https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+...
• sysOpOpPERAND 4y ago
  why is chrome having so many updates within the past few months? is it because of coverage? (more users?). i use chrome off and on between that and firefox depending on the site and i am surprised how often i've been reading about issues with chrome. should i switch browsers all together?
  • eternityforest 4y ago
    Basically everyone seems to be getting hacked. It's like all the hackers in the world snorted something and have been hacking nonstop all month.
  • hulitu 4y ago
    Every browser has updates every couple of weeks (without bringing nothing new). Quality of SW development has plumeted.
• whatev1942 4y ago
  What about CloudFlare ? Does this bring to question their decision to use V8 ?