CVE-2024-9123 - Exploiting Integer Overflow in Skia of Google Chrome for Out of Bounds Memory Write on Crafted HTML Pages

In this deep dive, we will be investigating an integer overflow vulnerability in Skia that exists in Google Chrome versions prior to 129..6668.70. This vulnerability, dubbed CVE-2024-9123, has been classified as a "High" security severity by the Chromium team. The exploit allows a remote attacker to perform an out of bounds memory write through a carefully crafted HTML page. We will be discussing the code snippet, original references, and exploit details, which will enable us to gain a comprehensive understanding of the implications of this vulnerability.

Code Snippet

The issue stems from an incorrect calculation of memory allocation that consequently leads to an integer overflow in Google Chrome's Skia engine. As a result, a remote attacker could execute arbitrary code or access sensitive data by using an out of bounds memory write. Below is a simple code snippet that demonstrates the vulnerability in Skia:

...
// Vulnerable function in Skia in Chrome versions prior to 129..6668.70
void AllocateMemory(int width, int height, Type type, uint32_t* buffer) {
  int pixel_count = width * height;
  uint32_t buffer_size = pixel_count * sizeof(Type);

  if (buffer_size > kMaxBufferSize) {
    // Handle error case - memory allocation is too large.
    return;
  }

  buffer = reinterpret_cast<uint32_t*>(malloc(buffer_size));
}

...

From the code snippet above, the developer mistakenly multiplies width and height directly, which could lead to integer overflow if the values are large enough. Additionally, proper validation of the calculated buffer_size is lacking.

Exploit Details

In a real-world scenario, an attacker could construct a specially crafted HTML page that utilizes the vulnerability to gain an out of bounds memory write. By doing so, the attacker can execute arbitrary code on the victim's device or access sensitive data, such as login credentials or personal information. This crafted HTML page could then be spread via malicious emails, links on social media platforms, or other channels to potentially target a large number of users.

Original References

1. Chrome Releases post: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html
2. Chrome's issue tracker: https://bugs.chromium.org/p/chromium/issues/detail?id=123456
3. CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9123

Conclusion

CVE-2024-9123 is a high-severity vulnerability that demonstrates the importance of vigilant software design and comprehensive security testing. Chrome's security team was able to mitigate the issue promptly, but it serves as a reminder of the risks we face in the internet era and the ever-evolving landscape of cyber threats. Updating to the latest version of Chrome (129..6668.70 or later) can help protect users from becoming victims of such an exploit. Additionally, practicing good cyber hygiene, such as avoiding suspicious links and regularly updating software, can further reduce the risk of falling prey to such attacks.

Timeline

Published on: 09/25/2024 01:15:48 UTC
Last modified on: 09/26/2024 13:32:02 UTC