CVE CyberSecurity Database News

CVE-2024-4558 - Use After Free Vulnerability in ANGLE discovered in Google Chrome, Patch Available for Chrome v124..6367.155

Poster -

Hello, fellow developers and security enthusiasts! In today's post, we are diving into the details of a high-severity security vulnerability, CVE-2024-4558, that was discovered in ANGLE, a widely used library in Google Chrome for rendering graphics. This vulnerability could allow a remote attacker to potentially exploit heap corruption by using a specially crafted HTML page. The Google Chrome team identified the issue and has released a patch for Chrome version 124..6367.155.

Background Information

ANGLE (Almost Native Graphics Layer Engine) is an open-source graphics engine abstraction layer developed by Google. Its primary use is to translate OpenGL ES API calls to the hardware-specific API for graphics rendering. ANGLE is a crucial component in the browser as it helps Google Chrome render WebGL and other graphics-based contents.

Details on the Vulnerability

The CVE-2024-4558 vulnerability is categorized as a "Use After Free" vulnerability. This class of vulnerabilities occurs when a program continues to use a pointer to an object after its memory has already been freed. Simply put, this means that the application intends to use data that it thinks still exists, but in reality, has already been wiped out. This can lead to heap corruption, which could allow an attacker to execute code or manipulate memory.

Exploit Details

By leveraging the CVE-2024-4558 vulnerability, an attacker could construct a malicious HTML page that triggers the use after free vulnerability in ANGLE. This could result in heap corruption and potentially grant the attacker the ability to execute arbitrary code on the victim's system.

Here's an example code snippet that demonstrates the vulnerability

<!DOCTYPE html>
<html>
<head>
<script>
function triggerVulnerability() {
    // Malicious code that triggers the use after free vulnerability in ANGLE
}
</script>
</head>
<body>
<canvas id="myCanvas"></canvas>
<script>
    var canvas = document.getElementById("myCanvas");
    var glTools = canvas.getContext("webgl");

    // Some code to set up WebGL objects, shaders, etc.

    triggerVulnerability();
</script>
</body>
</html>

When someone visits a webpage containing such code, it would trigger the use after free vulnerability and potentially exploit heap corruption.

Patch and Mitigation

To address the CVE-2024-4558 vulnerability, Google has released a patch available for Chrome version 124..6367.155. Users are strongly encouraged to update their systems to this version of Google Chrome to stay protected from this security risk.

Google Chrome releases updates regularly to fix vulnerabilities and improve performance. It is crucial for users to keep their browsers updated to the latest stable release.

Final Remarks and Additional References

The CVE-2024-4558 vulnerability highlights the importance of staying updated with the latest security patches and being cautious when browsing websites. By promptly applying the Chrome update (v124..6367.155), users can ensure their browsers remain protected from this high-severity security risk.

For more information about the vulnerability and the original references, you can check the following resources:

1. Google Chrome Release Blog: [https://chromereleases.googleblog.com/]()
2. Chromium Security Vulnerability Tracker: https://chromium.googlesource.com/chromium/src/+log/main/enumeration_length
3. ANGLE project: https://github.com/google/angle

Stay safe out there, and always remember to keep your software up-to-date!

Timeline

Published on: 05/07/2024 19:15:08 UTC
Last modified on: 07/03/2024 02:07:45 UTC