Unknown Attacker Chains Chrome and Windows Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21224 | Type Confusion RCE in Google Chrome/Chromium V8 JavaScript Engine CVE-2021-21224 is a type confusion vulnerability (CWE-843) in V8, the JavaScript engine used by Google Chrome and Chromium. An attacker triggers it by luring a user to open a crafted HTML page, causing V8 to mishandle object types during execution. Successful exploitation yields arbitrary code execution inside the Chrome renderer's sandbox, typically chained with a separate sandbox escape for full host compromise. Anyone running Google Chrome prior to 90.0.4430.85, or Chromium as packaged by Debian and Fedora, is affected. Exploitation is confirmed in the wild: Google shipped the fix in April 2021 after active attacks, a public PoC exists (crbug.com/1195777), the bug was observed in exploit-kit attack chains, EPSS assigns an 84% probability of near-term exploitation, and CISA added it to the KEV catalog on 2021-11-03. Do: Update Google Chrome to 90.0.4430.85 or later immediately; Debian and Fedora users should apply the chromium package updates issued by their vendors, per CISA KEV required actions. There is no strong workaround short of disabling JavaScript or restricting browsing to trusted sites. Treat this as urgent, since the flaw was already used in real attacks and exploit-kit chains, where it was typically paired with a sandbox escape for full system compromise. | 8.8 | 84% | KEV PoC |
| masson the order of billions of users (Chrome's global install base exceeds 1 billion desktops; Chromium additionally ships in Debian and Fedora) | |
| CVE-2021-31956 +1 in the same advisory: …31955 | Local Privilege Escalation via Out-of-Bounds Write in Microsoft Windows NTFS Microsoft Windows NTFS contains a privilege escalation flaw in which improper handling of integer underflow/overflow (CWE-191) leads to an out-of-bounds write (CWE-787), exploitable via a specially crafted application. A local attacker who can run such an application on a vulnerable Windows system can trigger the flaw and gain elevated privileges on that host. Because the flaw resides in the file system component shipped with Windows, essentially all supported Microsoft Windows releases are in scope. Exploitation is confirmed in the wild: CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2021-11-03 with a required action to apply vendor updates, though ransomware usage is unknown and no public proof-of-concept is cataloged. Predictive scoring (EPSS) places the 30-day exploitation probability at 22.3% (98th percentile). Do: Apply Microsoft security updates on all Windows systems per vendor instructions; this flaw was remediated in Microsoft's June 2021 monthly security (cumulative) updates, so verify each Windows build's installed cumulative update level against the Microsoft advisory. Prioritize patching multi-user and shared systems (terminal/RDS servers, kiosks, shared workstations) where local attackers can run untrusted code. As interim mitigation, restrict execution of untrusted local applications on vulnerable hosts. | 7.8 group max | 22% | KEV |
| mass~1 billion+ Windows systems (NTFS is the default filesystem on virtually every Windows installation) |
Full article356 words · extracted from infosecurity-magazine.com · click to collapse
Security researchers warn of a series of highly targeted attacks designed to compromise victim networks via Google Chrome and Microsoft Windows zero-day exploits.
The attackers are thought to have first exploited the now-patched CVE-2021-21224 remote code execution bug in Chrome.
“This vulnerability was related to a Type Mismatch bug in the V8 — a JavaScript engine used by Chrome and Chromium web-browsers,” explained Kaspersky. “It allows the attackers to exploit the Chrome renderer process: the processes that are responsible for what happens inside users’ tabs.”
The second stage was an elevation of privilege exploit linked to two separate vulnerabilities in the Microsoft Windows OS kernel. The first, CVE-2021-31955, can lead to the disclosure of sensitive kernel information, while the second, CVE-2021-31956, is a heap-based buffer overflow bug.
Kaspersky claimed that attackers CVE-2021-31956 alongside the Windows Notification Facility (WNF) to create arbitrary memory read/write primitives and execute malware modules with system privileges.
Once they’ve gained a foothold in victim networks by exploiting these three flaws, the stager modules execute a more sophisticated malware dropper from a remote server, which in turn installs to executables masquerading as legitimate Windows files.
One of these is a remote shell module designed to download and upload files, create processes, lie dormant for periods of time, and delete itself from the infected system, Kaspersky said.
Microsoft patched both vulnerabilities in this week’s Patch Tuesday security update round while Google has already fixed the Chrome flaw.
The research team has yet to link the attacks to any known threat actor, so is dubbing the group behind it “PuzzleMaker.”
“Overall, of late, we’ve been seeing several waves of high-profile threat activity being driven by zero-day exploits. It’s a reminder that zero days continue to be the most effective method for infecting targets,” argued Boris Larin, senior security researcher at Kaspersky’s Global Research and Analysis Team (GReAT).
“Now that these vulnerabilities have been made publicly known, it’s possible that we’ll see an increase of their usage in attacks by this and other threat actors. That means it’s very important for users to download the latest patch from Microsoft as soon as possible.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/unknown-attacker-chains-chrome/