Vulnerabilities > CVE-2020-6422 - Out-of-bounds Write vulnerability in multiple products

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
google
fedoraproject
debian
suse
opensuse
CWE-787
nessus
NVD
Published: 2020-03-23
Updated: 2023-11-07

Summary

Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vulnerable Configurations

Part Description Count
Application
Google
5610
Application
Opensuse
1
OS
Fedoraproject
3
OS
Debian
2
OS
Suse
2

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2020-39E0B8BD14.NASL
    descriptionUpdate to 80.0.3987.149. Upstream says it fixes
    last seen2020-05-31
    modified2020-03-30
    plugin id134990
    published2020-03-30
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134990
    titleFedora 30 : chromium (2020-39e0b8bd14)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory FEDORA-2020-39e0b8bd14.
#

include("compat.inc");

if (description)
{
  script_id(134990);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");

  script_cve_id("CVE-2019-20446", "CVE-2019-20503", "CVE-2020-10531", "CVE-2020-6378", "CVE-2020-6379", "CVE-2020-6380", "CVE-2020-6381", "CVE-2020-6382", "CVE-2020-6383", "CVE-2020-6384", "CVE-2020-6385", "CVE-2020-6386", "CVE-2020-6387", "CVE-2020-6388", "CVE-2020-6389", "CVE-2020-6390", "CVE-2020-6391", "CVE-2020-6392", "CVE-2020-6393", "CVE-2020-6394", "CVE-2020-6395", "CVE-2020-6396", "CVE-2020-6397", "CVE-2020-6398", "CVE-2020-6399", "CVE-2020-6400", "CVE-2020-6401", "CVE-2020-6402", "CVE-2020-6403", "CVE-2020-6404", "CVE-2020-6405", "CVE-2020-6406", "CVE-2020-6407", "CVE-2020-6408", "CVE-2020-6409", "CVE-2020-6410", "CVE-2020-6411", "CVE-2020-6412", "CVE-2020-6413", "CVE-2020-6414", "CVE-2020-6415", "CVE-2020-6416", "CVE-2020-6417", "CVE-2020-6418", "CVE-2020-6420", "CVE-2020-6422", "CVE-2020-6424", "CVE-2020-6425", "CVE-2020-6426", "CVE-2020-6427", "CVE-2020-6428", "CVE-2020-6429", "CVE-2020-6449");
  script_xref(name:"FEDORA", value:"2020-39e0b8bd14");

  script_name(english:"Fedora 30 : chromium (2020-39e0b8bd14)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis",
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description",
    value:
"Update to 80.0.3987.149. Upstream says it fixes '13' security issues,
but only lists these CVEs :

  - CVE-2020-6422: Use after free in WebGL

  - CVE-2020-6424: Use after free in media

  - CVE-2020-6425: Insufficient policy enforcement in
    extensions. 

  - CVE-2020-6426: Inappropriate implementation in V8

  - CVE-2020-6427: Use after free in audio

  - CVE-2020-6428: Use after free in audio

  - CVE-2020-6429: Use after free in audio.

  - CVE-2019-20503: Out of bounds read in usersctplib.

  - CVE-2020-6449: Use after free in audio

----

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled
by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420 

----

Update to 79.0.3945.130. Fixes the following security issues :

  - CVE-2020-6378

  - CVE-2020-6379

  - CVE-2020-6380

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bodhi.fedoraproject.org/updates/FEDORA-2020-39e0b8bd14"
  );
  script_set_attribute(
    attribute:"solution",
    value:"Update the affected chromium package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Google Chrome 80 JSCreate side-effect type confusion exploit');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:chromium");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:30");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/30");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^30([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 30", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);


flag = 0;
if (rpm_check(release:"FC30", reference:"chromium-80.0.3987.149-1.fc30", allowmaj:TRUE)) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromium");
}
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-202003-53.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-202003-53 (Chromium, Google Chrome: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers for details. Impact : A remote attacker could entice a user to open a specially crafted HTML or multimedia file using Chromium or Google Chrome, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-03-31
    modified2020-03-26
    plugin id134928
    published2020-03-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134928
    titleGLSA-202003-53 : Chromium, Google Chrome: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-365.NASL
    descriptionThis update for chromium to version 80.0.3987.149 fixes the following issues : Chromium was update to 80.0.3987.149 (bsc#1167090) : - CVE-2020-6422: Fixed a use after free in WebGL. - CVE-2020-6424: Fixed a use after free in media. - CVE-2020-6425: Fixed an insufficient policy enforcement in extensions. - CVE-2020-6426: Fixed an inappropriate implementation in V8. - CVE-2020-6427: Fixed a use after free in audio. - CVE-2020-6428: Fixed a use after free in audio. - CVE-2020-6429: Fixed a use after free in audio. - CVE-2019-20503: Fixed an out of bounds read in usersctplib. - CVE-2020-6449: Fixed a use after free in audio.
    last seen2020-05-31
    modified2020-03-23
    plugin id134822
    published2020-03-23
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134822
    titleopenSUSE Security Update : chromium (openSUSE-2020-365)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1270.NASL
    descriptionThe remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1270 advisory. - usrsctp: Out of bounds reads in sctp_load_addresses_from_init() (CVE-2019-20503) - chromium-browser: Use after free in WebGL (CVE-2020-6422) - chromium-browser: Use after free in media (CVE-2020-6424) - chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6425) - chromium-browser: Inappropriate implementation in V8 (CVE-2020-6426) - chromium-browser: Use after free in audio (CVE-2020-6427, CVE-2020-6428, CVE-2020-6429, CVE-2020-6449) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-02
    modified2020-04-01
    plugin id135086
    published2020-04-01
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135086
    titleRHEL 6 : chromium-browser (RHSA-2020:1270)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2020-7FD051B378.NASL
    descriptionUpdate to 80.0.3987.149. Upstream says it fixes
    last seen2020-05-31
    modified2020-03-24
    plugin id134842
    published2020-03-24
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134842
    titleFedora 31 : chromium (2020-7fd051b378)
  • NASL familyWindows
    NASL idGOOGLE_CHROME_80_0_3987_149.NASL
    descriptionThe version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.149. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_03_stable-channel-update-for-desktop_18 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-04
    modified2020-03-19
    plugin id134701
    published2020-03-19
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134701
    titleGoogle Chrome < 80.0.3987.149 Multiple Vulnerabilities
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_GOOGLE_CHROME_80_0_3987_149.NASL
    descriptionThe version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.149. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_03_stable-channel-update-for-desktop_18 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-04
    modified2020-03-19
    plugin id134700
    published2020-03-19
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134700
    titleGoogle Chrome < 80.0.3987.149 Multiple Vulnerabilities
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4645.NASL
    descriptionSeveral vulnerabilities have been discovered in the chromium web browser. - CVE-2019-20503 Natalie Silvanovich discovered an out-of-bounds read issue in the usrsctp library. - CVE-2020-6422 David Manouchehri discovered a use-after-free issue in the WebGL implementation. - CVE-2020-6424 Sergei Glazunov discovered a use-after-free issue. - CVE-2020-6425 Sergei Glazunov discovered a policy enforcement error related to extensions. - CVE-2020-6426 Avihay Cohen discovered an implementation error in the v8 JavaScript library. - CVE-2020-6427 Man Yue Mo discovered a use-after-free issue in the audio implementation. - CVE-2020-6428 Man Yue Mo discovered a use-after-free issue in the audio implementation. - CVE-2020-6429 Man Yue Mo discovered a use-after-free issue in the audio implementation. - CVE-2020-6449 Man Yue Mo discovered a use-after-free issue in the audio implementation.
    last seen2020-03-26
    modified2020-03-24
    plugin id134839
    published2020-03-24
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134839
    titleDebian DSA-4645-1 : chromium - security update

Redhat

rpms
  • chromium-browser-0:80.0.3987.149-1.el6_10
  • chromium-browser-debuginfo-0:80.0.3987.149-1.el6_10

References