CVE-2019-13720: Use-After-Free Zero Day in Google Chrome Exploited in the Wild

Though details are scant, Google released a patch for a Google Chrome vulnerability that has been exploited in the wild as a zero day.

Background

On October 31, Google published a Stable Channel Update for the desktop version of Google Chrome. This release fixes two vulnerabilities, one of which has been exploited in the wild as a zero day.

التحليل

CVE-2019-13720 is a use-after-free (UAF) vulnerability in audio for Google Chrome. It is unclear if the audio component referenced here is associated with content in the media/audio source. The flaw was reported to Google on October 29 by Kaspersky Lab researcher Alexey Kulaev and Anton Ivanov, Head of Advanced Threats Research and Detection. According to Kaspersky, the vulnerability was observed being exploited in the wild as a zero day.

A few days ago our technologies caught a new Chrome 0day exploit used in the wild and we reported it to Google. Just released-Chrome 78 patches it, credits to my colleagues @antonivanovm and Alexey Kulaev for finding the bug. https://t.co/Bgm0QtNO2d

— Costin Raiu (@craiu) November 1, 2019

Additional details about the flaw are restricted from the public, likely in an effort to give users and organizations time to apply patches. However, Kaspersky published some details on their blog, linking the vulnerability to an attack campaign called Operation WizardOpium.

In their blog, Kaspersky researchers identified the vulnerability by following malicious code injection on a Korean-language news portal. Due to “vulnerability disclosure principles,” Kaspersky has not disclosed specific details about the vulnerability itself. However, they do note the exploit “used a race condition bug between two threads due to missing proper synchronization between them.” This race condition results in the UAF that could lead to arbitrary code execution, which Kaspersky says “happens in our case.”

The other vulnerability patched in this Google Chrome for Desktop release is CVE-2019-13721, a UAF vulnerability in the PDFium library reported on October 12 by security researcher banananapenguin.

CVE-2019-13720 is the second UAF vulnerability in the audio component that has been patched in Google Chrome this month. On October 10, CVE-2019-13695, another audio UAF flaw, reported by Man Yue Mo of the Semmle Security Research Team was patched.

Proof of concept

At the time this blog was published, no proof of concept (PoC) for CVE-2019-13720 was available. However, Google acknowledges “an exploit” for the vulnerability “exists in the wild.”

الحل

Google addressed CVE-2019-13720 and CVE-2019-13721 in Google Chrome 78.0.3904.87 for Windows, Mac and Linux. Google notes the patched version will “roll out over the coming days/weeks,” according to the Security Advisory.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released. Additionally, Kaspersky provided indicators of compromise in their blog, which can also be used to identify systems affected by this operation.

الحصول على مزيد من المعلومات

• Google Chrome Stable Channel Update (78.0.3904.87)
• Google Stable Channel Update Addressing CVE-2019-13695

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 60-day trial of Tenable.io Vulnerability Management.