Summary:
In the headlines today, we have, Amidst the global lockdown, in the same week where Microsoft had confirmed seven critical vulnerabilities for Windows 10 users, Google has confirmed what it refers to as a critical security vulnerability. Google has not disclosed more details on the vulnerability, but independent cyber-security experts have dug into the details and found that the exploit stands marked ‘Reserved’ by the National Vulnerability Database of the United States. Google Chrome version 81.0.4044.113 takes care of this vulnerability.
Description:
A use after free vulnerability is one where attempts to access memory after it has been allocated elsewhere, freed in other words, can cause a crash. This could then lead to a compromise of your computer as the attacker can then execute arbitrary code on your system. Because the attack complexity of this vulnerability is thought to be low but the potential consequences high, with an attacker taking control of your computer, Google has rated this as a critical security issue.
Programmers that forget to call free() may end up hogging way more memory than they really need, which can bog down the rest of the system. But programmers who do call free() have to be really careful not to keep on using the freed-up memory block by mistake.
Otherwise, by the time they come to rely on the data in that memory block, another. In some cases, use-after-free bugs can allow an attacker to change the flow of control inside your program, including diverting the CPU to run untrusted code that the attacker just poked into memory from outside, thereby sidestepping any of the browser’s usual security checks or “are you sure” dialogs.
That’s the most serious sort of exploit, known in the jargon as RCE, short for remote code execution, which means just what it says – that a crook can run code on your computer remotely, without warning, even if they’re on the other side of the world.
If one has doubts if the Chrome browser on your Windows, Mac or Linux based system is running on this version, one can check yourself. Click on the three dots on the right top corner of the browser window. Click on Help>>About Chrome. You will get the version that is running. Match it with the patched version. Your system may be vulnerable if you are running as older version.
The reason Google might not have gone into full details is to avoid educating the hackers inadvertently and putting the Chrome users in jeopardy. Incidentally, the new update from Google Chrome brings with it a new tab organization feature as well.
Affected Products:
Google Chrome version prior to 81.0.4044.113
Advisory:
https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html
Mitigation:
Chrome has updated the patch and released for CVE-2020-6457.
Qualys customers can scan their network with QID(s)# 372517 to detect vulnerable assets. Kindly continue to follow on Qualys Threat Protection for more coverage on vulnerabilities.
References & Sources:
- https://nvd.nist.gov/vuln/detail/CVE-2020-6457
- https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html
