7 ms·

Only a score of 8.8?

by petra303 13d ago

teravor 13d ago
RCE inside sandbox, so requires chaining with another 0day.
- zahlman 13d ago
  What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?
  - jnwatson 13d ago
    It means it can execute arbitrary machine code in the sandbox.
    - zahlman 13d ago
      Okay, and why is that more of a security risk than executing arbitrary JavaScript in the sandbox?
      - p-e-w 13d ago
        It can do some things that JS can’t do, such as invalid pointer writes. But you are correct that this doesn’t automatically imply system access.
      - r_lee 13d ago
        because with proper code exec you can trigger other bugs to escalate beyond the sandbox, whereas with JS you'd have to find a bug to escape from JS to native can't get a proper ios/Android RCE with just JS code exec
      - insanitybit 13d ago
        Because Javascript theoretically can't just access files on disk. Control over the render would let you do that, if not for the process level sandbox, which constraints things like file access, system, calls, etc. But the process is still more capable than the VM. The process can talk to other processes via IPC, for example. That's why you don't go from "javascript -> computer is taken over", instead you go from "javascript -> renderer control -> computer is taken over".
      - arcfour 12d ago
        Among other things, JavaScript in the browser has no way to even express "kill PID 1234 on the user's machine" or "list the contents of `C:\Users\Documents` and upload all of the files" or "spawn cmd.exe on the user's machine". How would you even do these things if you could run any JavaScript in the browser? You can't. However, chrome.exe itself does because it's a native application, as is the sandboxed JavaScript interpreter inside of chrome.exe. (This is a very oversimplified explanation but I think this is the disconnect people are having)
        bawolff 12d ago
        > JavaScript in the browser has no way to even express ... "list the contents of `C:\Users\Documents` and upload all of the files" this is besides the point, but javascript has the file system api. anyways to your broad point, i dont think this is convincing. What's the difference between not having an api vs having an api that is disabled (e.g. the syscall exists but is filtered). Either way you are not taking the action. RCE in the sandbox is an important step in the bigger exploit chain, but not because you can express things in the traditional syscalls inside the sandbox.
        zahlman 12d ago
        Okay, but we're still talking about running machine code inside the sandbox, where that functionality is still not available.
        arcfour 12d ago
        The functionality is restricted, but the capability of expressing the intent at all exists.
    - r_lee 13d ago
      I think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.
      - ranger_danger 13d ago
        Seems to use OS-specific kernel syscall filtering facilities. Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#The-integrity-levels https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d... Linux: https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_sandboxing.md https://chromium.googlesource.com/chromium/src/+/0e94f26e8/d...
        r_lee 13d ago
        great link, thanks
        Genwald 13d ago
        V8 also has its own sandbox, which I believe exists in that sandbox. I assume that's the one this exploit has RCE in, but its unclear. https://chromium.googlesource.com/v8/v8.git/+/refs/heads/main/src/sandbox/README.md https://chromium.googlesource.com/v8/v8.git/+/refs/heads/mai...
        insanitybit 13d ago
        I would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.
    - TacticalCoder 12d ago
      > It means it can execute arbitrary machine code in the sandbox. Well which is precisely why we have sandboxes. To me "executing arbitrary code in the sandbox" is similar to "I don't give a flying fuck for it's what a sandbox is for". More information is needed. As someone commented: this has to be paired with at least another exploit to make anything remotely useful. A sandbox is a sandbox. We want to understand how "code running in a sandbox" is "actively exploited".
  - deleted 13d ago
    [deleted]
  - johnsmith1840 13d ago
    Memory isolation having one tab or account open on your bank and another on this page does not mean it could leak across the sandbox and steal bank account details but anything inside of your general page content can be lost
    - deleted 12d ago
      [deleted]
  - jimrandomh 13d ago
    It means it can execute native code inside the sandbox, as opposed to Javascript. While still sandboxed, this lets it access some parts of the attack surface that JS would not have been able to, some of which may have other exploits that allow escaping the rest of the way.
  - StilesCrisis 13d ago
    Chrome runs webpages in individual sandbox processes with very low privileges, as a defense-in-depth strategy. It generally requires at least two exploits to actually affect a user--first, get RCE in a sandboxed process, then find a separate vulnerability that lets you escape the sandbox process entirely. For this bug to have actually been used in the wild, there was almost certainly a second bug as well.
- iririririr 13d ago
  what is online ad networks for $100, alex
  - deleted 12d ago
    [deleted]
  - jeremyjh 12d ago
    I don't know why this is being downvoted. This is called malvertising and its one of the most significant vectors for exploiting a vulnerability like this. Its happened multiple times over the last two decades. My read of Google's disclosure is that there is likely no known escape from the sandbox. I don't agree this would be reported this way just because "user action" like "using web browser" is required. Even if this individual CVE is correctly an 8.8 there would be a critical assessment of a known chain. The only reason there wouldn't be, would be if the other vulnerability is known to Google but has no patch yet.
- TZubiri 12d ago
  This doesn't affect the score though, the reason there's 1.2 points less than the max is because there is a Required User Interaction. The user needs to visit a specific html page. Even with the sandbox protection layer, the rest of the parameters are maxed out.

Only a score of 8.8?

teravor 13d ago

RCE inside sandbox, so requires chaining with another 0day.

zahlman 13d ago
What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?
- jnwatson 13d ago
  It means it can execute arbitrary machine code in the sandbox.
  - zahlman 13d ago
    Okay, and why is that more of a security risk than executing arbitrary JavaScript in the sandbox?
    - p-e-w 13d ago
      It can do some things that JS can’t do, such as invalid pointer writes. But you are correct that this doesn’t automatically imply system access.
    - r_lee 13d ago
      because with proper code exec you can trigger other bugs to escalate beyond the sandbox, whereas with JS you'd have to find a bug to escape from JS to native can't get a proper ios/Android RCE with just JS code exec
    - insanitybit 13d ago
      Because Javascript theoretically can't just access files on disk. Control over the render would let you do that, if not for the process level sandbox, which constraints things like file access, system, calls, etc. But the process is still more capable than the VM. The process can talk to other processes via IPC, for example. That's why you don't go from "javascript -> computer is taken over", instead you go from "javascript -> renderer control -> computer is taken over".
    - arcfour 12d ago
      Among other things, JavaScript in the browser has no way to even express "kill PID 1234 on the user's machine" or "list the contents of `C:\Users\Documents` and upload all of the files" or "spawn cmd.exe on the user's machine". How would you even do these things if you could run any JavaScript in the browser? You can't. However, chrome.exe itself does because it's a native application, as is the sandboxed JavaScript interpreter inside of chrome.exe. (This is a very oversimplified explanation but I think this is the disconnect people are having)
      - bawolff 12d ago
        > JavaScript in the browser has no way to even express ... "list the contents of `C:\Users\Documents` and upload all of the files" this is besides the point, but javascript has the file system api. anyways to your broad point, i dont think this is convincing. What's the difference between not having an api vs having an api that is disabled (e.g. the syscall exists but is filtered). Either way you are not taking the action. RCE in the sandbox is an important step in the bigger exploit chain, but not because you can express things in the traditional syscalls inside the sandbox.
      - zahlman 12d ago
        Okay, but we're still talking about running machine code inside the sandbox, where that functionality is still not available.
        arcfour 12d ago
        The functionality is restricted, but the capability of expressing the intent at all exists.
  - r_lee 13d ago
    I think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.
    - ranger_danger 13d ago
      Seems to use OS-specific kernel syscall filtering facilities. Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#The-integrity-levels https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d... Linux: https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_sandboxing.md https://chromium.googlesource.com/chromium/src/+/0e94f26e8/d...
      - r_lee 13d ago
        great link, thanks
      - Genwald 13d ago
        V8 also has its own sandbox, which I believe exists in that sandbox. I assume that's the one this exploit has RCE in, but its unclear. https://chromium.googlesource.com/v8/v8.git/+/refs/heads/main/src/sandbox/README.md https://chromium.googlesource.com/v8/v8.git/+/refs/heads/mai...
        insanitybit 13d ago
        I would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.
  - TacticalCoder 12d ago
    > It means it can execute arbitrary machine code in the sandbox. Well which is precisely why we have sandboxes. To me "executing arbitrary code in the sandbox" is similar to "I don't give a flying fuck for it's what a sandbox is for". More information is needed. As someone commented: this has to be paired with at least another exploit to make anything remotely useful. A sandbox is a sandbox. We want to understand how "code running in a sandbox" is "actively exploited".
- deleted 13d ago
  [deleted]
- johnsmith1840 13d ago
  Memory isolation having one tab or account open on your bank and another on this page does not mean it could leak across the sandbox and steal bank account details but anything inside of your general page content can be lost
  - deleted 12d ago
    [deleted]
- jimrandomh 13d ago
  It means it can execute native code inside the sandbox, as opposed to Javascript. While still sandboxed, this lets it access some parts of the attack surface that JS would not have been able to, some of which may have other exploits that allow escaping the rest of the way.
- StilesCrisis 13d ago
  Chrome runs webpages in individual sandbox processes with very low privileges, as a defense-in-depth strategy. It generally requires at least two exploits to actually affect a user--first, get RCE in a sandboxed process, then find a separate vulnerability that lets you escape the sandbox process entirely. For this bug to have actually been used in the wild, there was almost certainly a second bug as well.
iririririr 13d ago
what is online ad networks for $100, alex
- deleted 12d ago
  [deleted]
- jeremyjh 12d ago
  I don't know why this is being downvoted. This is called malvertising and its one of the most significant vectors for exploiting a vulnerability like this. Its happened multiple times over the last two decades. My read of Google's disclosure is that there is likely no known escape from the sandbox. I don't agree this would be reported this way just because "user action" like "using web browser" is required. Even if this individual CVE is correctly an 8.8 there would be a critical assessment of a known chain. The only reason there wouldn't be, would be if the other vulnerability is known to Google but has no patch yet.
TZubiri 12d ago
This doesn't affect the score though, the reason there's 1.2 points less than the max is because there is a Required User Interaction. The user needs to visit a specific html page. Even with the sandbox protection layer, the rest of the parameters are maxed out.