Vulnerabilities > CVE-2012-5119 - Race Condition vulnerability in Google Chrome

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
google
CWE-362
nessus
NVD
Published: 2012-11-07
Updated: 2023-11-07

Summary

Race condition in Pepper, as used in Google Chrome before 23.0.1271.64, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to buffers.

Vulnerable Configurations

Part Description Count
Application
Google
2517

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leveraging Race Conditions
    This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
  • Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
    This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.

Nessus

  • NASL familyWindows
    NASL idGOOGLE_CHROME_23_0_1271_64.NASL
    descriptionThe version of Google Chrome installed on the remote host is earlier than 23.0.1271.64 and is, therefore, affected by the following vulnerabilities : - Use-after-free errors exist related to SVG filter handling, video layout, extension tab handling and plug-in placeholder handling. (CVE-2012-5116, CVE-2012-5121, CVE-2012-5125, CVE-2012-5126) - An error exists related to inappropriate SVG subresource loading in the
    last seen2020-06-01
    modified2020-06-02
    plugin id62861
    published2012-11-08
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/62861
    titleGoogle Chrome < 23.0.1271.64 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(62861);
  script_version("1.9");
  script_cvs_date("Date: 2019/12/04");

  script_cve_id(
    "CVE-2012-5116",
    "CVE-2012-5117",
    "CVE-2012-5119",
    "CVE-2012-5121",
    "CVE-2012-5122",
    "CVE-2012-5123",
    "CVE-2012-5124",
    "CVE-2012-5125",
    "CVE-2012-5126",
    "CVE-2012-5127",
    "CVE-2012-5128"
  );
  script_bugtraq_id(56413);

  script_name(english:"Google Chrome < 23.0.1271.64 Multiple Vulnerabilities");
  script_summary(english:"Checks version number of Google Chrome");

  script_set_attribute(attribute:"synopsis", value:
"The remote host contains a web browser that is affected by multiple
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Google Chrome installed on the remote host is earlier
than 23.0.1271.64 and is, therefore, affected by the following
vulnerabilities :

  - Use-after-free errors exist related to SVG filter
    handling, video layout, extension tab handling and
    plug-in placeholder handling. (CVE-2012-5116,
    CVE-2012-5121, CVE-2012-5125, CVE-2012-5126)

  - An error exists related to inappropriate SVG
    subresource loading in the 'img' context.
    (CVE-2012-5117)

  - A race condition exists related to 'Pepper' buffer
    handling. (CVE-2012-5119)

  - A bad cast error exists related to input handling.
    (CVE-2012-5122)

  - Out-of-bounds reads exist related to Skia.
    (CVE-2012-5123)

  - A memory corruption error exists related to texture
    handling. (CVE-2012-5124)

  - An integer overflow error exists related to 'WebP'
    handling. This error can lead to out-of-bounds reads.
    (CVE-2012-5127)

  - An improper write error exists related to the 'v8'
    JavaScript engine. (CVE-2012-5128)

Successful exploitation of any of these issues could lead to an
application crash or even allow arbitrary code execution, subject to the
user's privileges.");
  # https://chromereleases.googleblog.com/2012/11/stable-channel-release-and-beta-channel.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a3dbf13e");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Google Chrome 23.0.1271.64 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-5128");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/11/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/11/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/11/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("google_chrome_installed.nasl");
  script_require_keys("SMB/Google_Chrome/Installed");

  exit(0);
}

include("google_chrome_version.inc");

get_kb_item_or_exit("SMB/Google_Chrome/Installed");

installs = get_kb_list("SMB/Google_Chrome/*");
google_chrome_check_version(installs:installs, fix:'23.0.1271.64', severity:SECURITY_HOLE);
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_209C068D28BE11E2916000262D5ED8EE.NASL
    descriptionGoogle Chrome Releases reports : [157079] Medium CVE-2012-5127: Integer overflow leading to out-of-bounds read in WebP handling. Credit to Phil Turnbull. [Linux 64-bit only] [150729] Medium CVE-2012-5120: Out-of-bounds array access in v8. Credit to Atte Kettunen of OUSPG. [143761] High CVE-2012-5116: Use-after-free in SVG filter handling. Credit to miaubiz. [Mac OS only] [149717] High CVE-2012-5118: Integer bounds check issue in GPU command buffers. Credit to miaubiz. [154055] High CVE-2012-5121: Use-after-free in video layout. Credit to Atte Kettunen of OUSPG. [145915] Low CVE-2012-5117: Inappropriate load of SVG subresource in img context. Credit to Felix Grobert of the Google Security Team. [149759] Medium CVE-2012-5119: Race condition in Pepper buffer handling. Credit to Fermin Serna of the Google Security Team. [154465] Medium CVE-2012-5122: Bad cast in input handling. Credit to Google Chrome Security Team (Inferno). [154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in Skia. Credit to Google Chrome Security Team (Inferno). [155323] High CVE-2012-5124: Memory corruption in texture handling. Credit to Al Patrick of the Chromium development community. [156051] Medium CVE-2012-5125: Use-after-free in extension tab handling. Credit to Alexander Potapenko of the Chromium development community. [156366] Medium CVE-2012-5126: Use-after-free in plug-in placeholder handling. Credit to Google Chrome Security Team (Inferno). [157124] High CVE-2012-5128: Bad write in v8. Credit to Google Chrome Security Team (Cris Neckar).
    last seen2020-06-01
    modified2020-06-02
    plugin id62856
    published2012-11-08
    reporterThis script is Copyright (C) 2012-2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/62856
    titleFreeBSD : chromium -- multiple vulnerabilities (209c068d-28be-11e2-9160-00262d5ed8ee)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2016 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#    copyright notice, this list of conditions and the following
#    disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#    published online in any format, converted to PDF, PostScript,
#    RTF and other formats) must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
# 
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

include("compat.inc");

if (description)
{
  script_id(62856);
  script_version("$Revision: 1.3 $");
  script_cvs_date("$Date: 2016/05/26 16:04:30 $");

  script_cve_id("CVE-2012-5116", "CVE-2012-5117", "CVE-2012-5118", "CVE-2012-5119", "CVE-2012-5120", "CVE-2012-5121", "CVE-2012-5122", "CVE-2012-5123", "CVE-2012-5124", "CVE-2012-5125", "CVE-2012-5126", "CVE-2012-5127", "CVE-2012-5128");

  script_name(english:"FreeBSD : chromium -- multiple vulnerabilities (209c068d-28be-11e2-9160-00262d5ed8ee)");
  script_summary(english:"Checks for updated package in pkg_info output");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote FreeBSD host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Google Chrome Releases reports :

[157079] Medium CVE-2012-5127: Integer overflow leading to
out-of-bounds read in WebP handling. Credit to Phil Turnbull.

[Linux 64-bit only] [150729] Medium CVE-2012-5120: Out-of-bounds array
access in v8. Credit to Atte Kettunen of OUSPG.

[143761] High CVE-2012-5116: Use-after-free in SVG filter handling.
Credit to miaubiz.

[Mac OS only] [149717] High CVE-2012-5118: Integer bounds check issue
in GPU command buffers. Credit to miaubiz.

[154055] High CVE-2012-5121: Use-after-free in video layout. Credit to
Atte Kettunen of OUSPG.

[145915] Low CVE-2012-5117: Inappropriate load of SVG subresource in
img context. Credit to Felix Grobert of the Google Security Team.

[149759] Medium CVE-2012-5119: Race condition in Pepper buffer
handling. Credit to Fermin Serna of the Google Security Team.

[154465] Medium CVE-2012-5122: Bad cast in input handling. Credit to
Google Chrome Security Team (Inferno).

[154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in Skia.
Credit to Google Chrome Security Team (Inferno).

[155323] High CVE-2012-5124: Memory corruption in texture handling.
Credit to Al Patrick of the Chromium development community.

[156051] Medium CVE-2012-5125: Use-after-free in extension tab
handling. Credit to Alexander Potapenko of the Chromium development
community.

[156366] Medium CVE-2012-5126: Use-after-free in plug-in placeholder
handling. Credit to Google Chrome Security Team (Inferno).

[157124] High CVE-2012-5128: Bad write in v8. Credit to Google Chrome
Security Team (Cris Neckar)."
  );
  # http://googlechromereleases.blogspot.nl/search/label/Stable%20updates
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?bdc75d6a"
  );
  # http://www.freebsd.org/ports/portaudit/209c068d-28be-11e2-9160-00262d5ed8ee.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5531bcaa"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:chromium");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/11/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/11/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/11/08");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2016 Tenable Network Security, Inc.");
  script_family(english:"FreeBSD Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");

  exit(0);
}


include("audit.inc");
include("freebsd_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (pkg_test(save_report:TRUE, pkg:"chromium<23.0.1271.64")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

Oval

accepted2013-08-12T04:08:12.056-04:00
classvulnerability
contributors
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
definition_extensions
commentGoogle Chrome is installed
ovaloval:org.mitre.oval:def:11914
descriptionRace condition in Pepper, as used in Google Chrome before 23.0.1271.64, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to buffers.
familywindows
idoval:org.mitre.oval:def:15977
statusaccepted
submitted2012-11-07T10:16:29.050-05:00
titleRace condition in Pepper, as used in Google Chrome before 23.0.1271.64, via vectors related to buffers
version42

References