CVE-2024-9960

Use After Free (CWE-416)

Published: Oct 15, 2024 / Updated: 35d ago

010
CVSS 8.8EPSS 0.04%High
CVE info copied to clipboard

Summary

A use-after-free vulnerability has been identified in Dawn, a component of Google Chrome versions prior to 130.0.6723.58. This vulnerability could potentially allow an attacker to exploit heap corruption through a specially crafted HTML page. The vulnerability is classified as medium severity according to Chromium's security assessment, but has a CVSS base score of 8.8, indicating a high severity.

Impact

If successfully exploited, this vulnerability could lead to severe consequences: 1. Heap corruption, potentially resulting in arbitrary code execution. 2. High impact on confidentiality, integrity, and availability, possibly leading to unauthorized access to sensitive information, data modification, and service disruption. 3. Potential privilege escalation, depending on the specifics of the exploitation. 4. The vulnerability can be exploited remotely, increasing its severity. However, it's important to note that user interaction is required for successful exploitation, which slightly mitigates the risk.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Google Chrome versions 130.0.6723.58 and later have addressed this vulnerability. Users and administrators should update to the latest version of Google Chrome to mitigate this risk.

Mitigation

1. Update Google Chrome: Immediately update to version 130.0.6723.58 or later. 2. Enable automatic updates for Google Chrome to receive security patches promptly. 3. Educate users about the risks of visiting untrusted websites or opening suspicious HTML content. 4. Implement proper network segmentation to limit the potential impact of successful exploits. 5. Consider implementing application whitelisting to prevent unauthorized code execution. 6. Implement robust logging and monitoring to detect potential exploitation attempts. 7. Utilize sandboxing technologies to isolate browser processes and limit the impact of potential exploits.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (380705)

Oct 15, 2024 at 7:53 AM
First Article

Feedly found the first article mentioning CVE-2024-9960. See article

Oct 15, 2024 at 8:05 PM / Neowin News Feed for: Software
CVE Assignment

NVD published the first details for CVE-2024-9960

Oct 15, 2024 at 9:15 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 15, 2024 at 9:21 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209038)

Oct 15, 2024 at 11:15 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209037)

Oct 15, 2024 at 11:15 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (209036)

Oct 15, 2024 at 11:15 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.7%)

Oct 16, 2024 at 9:58 AM
CVSS

A CVSS base score of 8.8 has been assigned.

Oct 16, 2024 at 8:40 PM / nvd
Static CVE Timeline Graph

Affected Systems

Google/chrome
+null more

Patches

Microsoft
+null more

References

MS-ISAC CYBERSECURITY ADVISORY - Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution - PATCH NOW
Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user.

News

Multiple vulnerabilities in Prisma Access Browser
A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.
Fedora 41 : chromium (2024-3a6f9ab958)
Nessus Plugin ID 211343 with High Severity Synopsis The remote Fedora host is missing one or more security updates. Description The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3a6f9ab958 advisory. Update to 130.0.6723.58 * High CVE-2024-9954: Use after free in AI * Medium CVE-2024-9955: Use after free in Web Authentication * Medium CVE-2024-9956: Inappropriate implementation in Web Authentication * Medium CVE-2024-9957: Use after free in UI * Medium CVE-2024-9958: Inappropriate implementation in PictureInPicture * Medium CVE-2024-9959: Use after free in DevTools * Medium CVE-2024-9960: Use after free in Dawn * Medium CVE-2024-9961:
Patch Tuesday November 2024 - 3 Zero Days!
So, without further ado, here’s the chart of MS patches that affect Windows platforms in the past month. Of this months patches only 8 are critical and 88 important.
PAN-SA-2024-0016 Chromium: Monthly Vulnerability Updates (Severity: HIGH)
Product Confidentiality HIGH Product Integrity HIGH
Chromium: CVE-2024-9960 Use after free in Dawn
See 51 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI