{"id":120374,"date":"2022-08-19T14:38:06","date_gmt":"2022-08-19T21:38:06","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=120374"},"modified":"2023-10-13T07:16:37","modified_gmt":"2023-10-13T14:16:37","slug":"uncovering-a-chromeos-remote-memory-corruption-vulnerability","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/","title":{"rendered":"Uncovering a ChromeOS remote memory corruption vulnerability"},"content":{"rendered":"\n<p>Microsoft discovered a memory corruption vulnerability in a ChromeOS component that can be triggered remotely, allowing attackers to perform either a denial-of-service (DoS) or, in extreme cases, remote code execution (RCE). Following our <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/04\/26\/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn\/\">D-Bus blog post<\/a> that focused on Linux, we searched for similar D-Bus patterns on other platforms by auditing D-Bus services and their handler code. After locating a local memory corruption issue, we discovered the vulnerability could be remotely triggered by manipulating audio metadata. Attackers could have lured users into meeting these conditions, such as by simply playing a new song in a browser or from a paired Bluetooth device, or leveraged adversary-in-the-middle (AiTM) capabilities to exploit the vulnerability remotely.<\/p>\n\n\n\n<p>After carefully reviewing the implications, a Microsoft security researcher shared the vulnerability with Google in April 2022 and also reported it with the <a href=\"https:\/\/bugs.chromium.org\/p\/chromium\/issues\/detail?id=1320917\">Chromium bug tracking system<\/a>. Fixes for the vulnerability, which is assigned as <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-2587\">CVE-2022-2587<\/a> and has a Common Vulnerability Scoring System (<a href=\"https:\/\/www.first.org\/cvss\/\">CVSS<\/a>) score of 9.8 (classifying the vulnerability as critical), were quickly released and have been successfully <a href=\"https:\/\/chromereleases.googleblog.com\/2022\/06\/stable-channel-update-for-chromeos.html\">deployed to end users<\/a>. We\u2019d like to thank the Google team and the Chromium community for their professional resolution and collaborative efforts.<\/p>\n\n\n\n<p>This research coupled with the recent release of <a href=\"https:\/\/cloud.google.com\/blog\/products\/chrome-enterprise\/chromeos-flex-ready-to-scale-to-pcs-and-macs\">ChromeOS Flex<\/a>, which can convert various legacy PCs and Macs into Chromebooks, emphasizes the importance of analyzing and monitoring security for devices running ChromeOS. Moreover, as even the most hardened operating systems might contain security bugs, we emphasize the need for strong monitoring of all cross-platform devices and operating systems. The best approach for protecting unmanaged devices is by using <a href=\"https:\/\/docs.microsoft.com\/microsoft-365\/security\/defender-endpoint\/device-discovery?view=o365-worldwide\">Microsoft Defender for Endpoint&#8217;s device discovery capabilities<\/a> to monitor suspicious traffic and help detect attacker activities on such devices.<\/p>\n\n\n\n<p>In this blog post, we share some information about the vulnerability and examine how it could be triggered as well as the possible implications. Displaying how our cross-domain expertise helps us uncover new and unknown threats in the effort to continually improve security for all, we also share details from our research with the larger security community to emphasize the importance of collaboration to secure platforms and devices.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">An overview of ChromeOS security<\/h2>\n\n\n\n<p>One well-known operating system that uses D-Bus is ChromeOS. ChromeOS is a Google-proprietary Linux-based operating system that runs on Chromebooks, Chromeboxes, Chromebits and Chromebases. ChromeOS is a closed-source system with open-source components that are derived from ChromiumOS, and the operating system uses Google\u2019s own Chrome browser as its principal user interface.<\/p>\n\n\n\n<p>In terms of security, ChromeOS is well <a href=\"https:\/\/www.chromium.org\/chromium-os\/chromiumos-design-docs\/system-hardening\/\">hardened<\/a>; some of the security features on ChromeOS include:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Hardened sandbox (called minijail)<\/li><li>Verified boot<\/li><li>Locked-down filesystem (mounted with <em>noexec<\/em>, <em>nosuid<\/em>, <em>nodev<\/em>) and dm-verity<\/li><li>Root user restrictions (SECURE_NOROOT)<\/li><li>When development mode is entered, all locally stored data is wiped<\/li><\/ul>\n\n\n\n<p>As with other modern browsers, exploiting ChromeOS usually requires chaining vulnerabilities together. Due to hardening measures in ChromeOS, discovering vulnerabilities became a specific niche and, therefore, the number of public vulnerabilities is quite low compared to other operating systems. ChromeOS vulnerabilities generally fall into one of three different classes:<\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>ChromeOS-specific logic vulnerabilities<\/li><li>ChromeOS-specific memory-corruption vulnerabilities<\/li><li>Broader threats such as Chrome browser vulnerabilities<\/li><\/ol>\n\n\n\n<p>In this case, the discovered vulnerability falls under the second class, ChromeOS-specific memory-corruption vulnerabilities.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Bug hunting<\/h2>\n\n\n\n<p>Having discussed and extensively <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/04\/26\/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn\/\">researched D-Bus<\/a>, we continued this analysis by enumerating the D-Bus services offered on ChromeOS. In general, D-Bus is an Inter-Process-Communication (IPC) mechanism that\u2019s popular on desktop platforms, specifically Linux.<\/p>\n\n\n\n<p>ChromeOS\u2019s <a href=\"https:\/\/chromium.googlesource.com\/chromiumos\/docs\/+\/HEAD\/developer_mode.md\">developer mode<\/a> offers the <em>dbus-send<\/em> utility to send messages over D-bus. As there are many D-Bus services offered on ChromeOS (usually identified by the \u201c<em>org.chromium<\/em>\u201d prefix), we automated the process and used the <em>dbus-send<\/em> utility to fetch the full tree of services and their exported methods and signals.<\/p>\n\n\n\n<p>Because most D-Bus services support the <em>org.freedesktop.DBus.Introspectable<\/em> interface, it\u2019s possible to dynamically fetch exported methods and signals without reading the source code or reverse-engineering the binaries.<\/p>\n\n\n\n<p>Fetching all the exported service names can be performed using the following command:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dbus-send --system --dest=org.freedesktop.DBus --type=method_call --print-reply \/org\/freedesktop\/DBus org.freedesktop.DBus.ListNames<\/pre>\n\n\n\n<p>Using <em>org.chromium.ResourceManager<\/em> as an example, each service can then be enumerated for its declared methods and signals via the following command:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dbus-send --system --dest=org.chromium.ResourceManager --type=method_call --print-reply \/org\/chromium\/ResourceManager org.freedesktop.DBus.Introspectable.Introspect<\/pre>\n\n\n\n<p>Considering that the more input a method receives, the higher the probability of finding a security issue, we then focused on methods that export arbitrarily large inputs, such as strings or arrays. It wasn\u2019t long before we found an interesting service: <em>org.chromium.cras<\/em>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The vulnerability<\/h2>\n\n\n\n<p>The <em>org.chromium.cras<\/em> D-Bus name is owned by CRAS (ChromiumOS Audio Server), which has a <a href=\"http:\/\/chromium.org\/chromium-os\/chromiumos-design-docs\/cras-chromeos-audio-server\/\">well-documented architecture<\/a> under the ChromiumOS wiki pages. In essence, CRAS is a server that resides between the operating system and ALSA (Advanced Linux Sound Architecture) as a means of routing audio to newly attached audio-supporting peripherals, like USB speakers and Bluetooth headsets.<\/p>\n\n\n\n<p>Reviewing the exported methods uncovered one method with a particularly interesting handling function: <em>SetPlayerIdentity<\/em>, which gets one string (an argument called <em>identity<\/em>) as an input. Since ChromiumOS is open-sourced, tracking the calls is straightforward:<\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>In <a href=\"https:\/\/chromium.googlesource.com\/chromiumos\/third_party\/adhd\/+\/ec204a352e068152de3020b9f91854996f95f217\/cras\/src\/server\/cras_dbus_control.c\"><em>cras_dbus_control.c<\/em>,<\/a> the handler function for <em>SetPlayerIdentity<\/em> is <em>handle_set_player_identity<\/em>, which extracts the <em>identity<\/em> argument from the D-Bus message and invoke the <em>cras_bt_player_update_identity<\/em> function.<\/li><li>In <a href=\"https:\/\/chromium.googlesource.com\/chromiumos\/third_party\/adhd\/+\/ec204a352e068152de3020b9f91854996f95f217\/cras\/src\/server\/cras_bt_player.c\"><em>cras_bt_player.c<\/em>,<\/a> the function <em>cras_bt_player_update_identity<\/em> that was called checks that the <em>identity<\/em> input value is not null and is different than the current player <em>identity<\/em> string (saved under <em>player.identity<\/em>). If so, it copies the <em>identity<\/em> variable to <em>player.identity<\/em> using the C library function <a href=\"https:\/\/www.cplusplus.com\/reference\/cstring\/strcpy\/\"><em>strcpy<\/em><\/a>. Of note, \u201cplayer\u201d is a global variable in the <em>cras_bt_player<\/em> module and includes an <em>identity<\/em> field in it, among others.<\/li><\/ol>\n\n\n\n<p>To the experienced security engineer, the mention of the <em>strcpy<\/em> function immediately raises red flags. The <em>strcpy <\/em>function is known to cause various memory corruption vulnerabilities since it doesn\u2019t perform any bounds check and is therefore considered unsafe. As there are no bounds checks on the user-supplied <em>identity<\/em> argument before invoking <em>strcpy <\/em>(besides the default message length limitations for D-Bus messages), we were confident we could trigger a heap-based buffer overflow, therefore triggering a memory corruption vulnerability.<\/p>\n\n\n\n<p>Heap-based buffer overflows can be the cause of multiple vulnerabilities, most notoriously leading to arbitrary code execution through various means. This could include overriding a function callback in an allocated object or overriding chunk metadata, which can trigger other unexpected behavior during the lifetime of a program.<\/p>\n\n\n\n<p>Checking how the <em>player.identity<\/em> string is initialized shows that it\u2019s set in the <em>cras_bt_player_init<\/em> function as the result of <em>malloc(128)<\/em>, which means it\u2019s allocated on the user\u2019s heap with 128 bytes.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"960\" height=\"499\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-1.-The-vulnerable-function-with-the-strcpy-invocation-in-it.png\" alt=\"Code depicting the vulnerable function with the strcpy invocation in it\" class=\"wp-image-120386\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-1.-The-vulnerable-function-with-the-strcpy-invocation-in-it.png 960w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-1.-The-vulnerable-function-with-the-strcpy-invocation-in-it-300x156.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-1.-The-vulnerable-function-with-the-strcpy-invocation-in-it-768x399.png 768w\" sizes=\"(max-width: 960px) 100vw, 960px\" \/><figcaption>Figure 1. The vulnerable function with the <em>strcpy<\/em> invocation in it<\/figcaption><\/figure>\n\n\n\n<p>Therefore, the vulnerability could be triggered using a single command line by sending the <em>identity<\/em> user-controlled D-Bus argument with more than 128 bytes, as displayed in our example code below:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dbus-send --system --dest=org.chromium.cras --type=method_call --print-reply \/org\/chromium\/cras org.chromium.cras.Control.SetPlayerIdentity string:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<\/pre>\n\n\n\n<p>As most users don\u2019t need to enable ChromeOS\u2019s developer mode and, thus, can\u2019t use the <em>dbus-send<\/em> utility, our next task was to find a way to trigger the bug without using developer mode.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Triggering the bug remotely<\/h2>\n\n\n\n<p>Thinking we spotted a local memory corruption issue, we wanted to better understand how to trigger the bug. Since the involved functions exclusively get triggered from D-Bus, we looked for functions that trigger the <em>SetPlayerIdentity<\/em> D-Bus method\u2014if the arguments to those don\u2019t have bounds checks, then those functions could be used to trigger the vulnerability.<\/p>\n\n\n\n<p>Examining the open-source ChromiumOS repositories found that the CRAS audio client invokes the <em>SetPlayerIdentity <\/em>method (and exports a function with the same name). In turn, it\u2019s called by the CRAS audio handler component\u2019s method <em>MediaSessionMetadataChanged<\/em>, which extracts the <em>identity<\/em> from a metadata structure representing a song&#8217;s title:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"960\" height=\"493\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-2.-SetPlayerIdentity-triggered-from-metadata-changes.png\" alt=\"Code depicting SetPlayerIdentity triggered from metadata changes\" class=\"wp-image-120383\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-2.-SetPlayerIdentity-triggered-from-metadata-changes.png 960w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-2.-SetPlayerIdentity-triggered-from-metadata-changes-300x154.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-2.-SetPlayerIdentity-triggered-from-metadata-changes-768x394.png 768w\" sizes=\"(max-width: 960px) 100vw, 960px\" \/><figcaption>Figure 2. SetPlayerIdentity triggered from metadata changes<\/figcaption><\/figure>\n\n\n\n<p>At this point, it was clear that the vulnerability could be triggered via changes to the audio metadata. Looking for <em>MediaSessionMetadataChanged<\/em> invocations revealed two interesting cases that could both be triggered remotely:<\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>From the browser: the browser\u2019s media component invokes the function when metadata is changed, such as when playing a new song in the browser.<\/li><li>From Bluetooth: the media session service in the operating system invokes the function when a song\u2019s metadata changes, which can happen when playing a new song from a paired Bluetooth device.<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-3.-Call-tree-displaying-how-browser-or-Bluetooth-media-metadata-changes-ultimately-trigger-the-vulnerable-component-776x1024.png\" alt=\"Call tree depicting how browser or bluetooth devices can trigger MediaSessionMetadataChanged, then SetPlayerIdentity to be sent over D-Bus, triggering handle_control_message, then handle_set_player_identity, and finally the vulnerable function: cras_bt_player_update_identity.\" class=\"wp-image-120380\" width=\"388\" height=\"512\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-3.-Call-tree-displaying-how-browser-or-Bluetooth-media-metadata-changes-ultimately-trigger-the-vulnerable-component-776x1024.png 776w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-3.-Call-tree-displaying-how-browser-or-Bluetooth-media-metadata-changes-ultimately-trigger-the-vulnerable-component-227x300.png 227w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-3.-Call-tree-displaying-how-browser-or-Bluetooth-media-metadata-changes-ultimately-trigger-the-vulnerable-component-768x1013.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/Figure-3.-Call-tree-displaying-how-browser-or-Bluetooth-media-metadata-changes-ultimately-trigger-the-vulnerable-component.png 960w\" sizes=\"(max-width: 388px) 100vw, 388px\" \/><figcaption>Figure 3. Call tree displaying how browser or Bluetooth media metadata changes ultimately trigger the vulnerable function<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Implications and reporting<\/h2>\n\n\n\n<p>We reported the vulnerability to Google in April 2022 as a part of the Chromium bug tracking system and were assigned <a href=\"https:\/\/bugs.chromium.org\/p\/chromium\/issues\/detail?id=1320917\">Issue 1320917<\/a>, which immediately got assigned as a priority 1 security bug. In parallel, we tracked the issue internally in <a href=\"https:\/\/www.microsoft.com\/msrc\/msvr\">Microsoft Security Vulnerability Research<\/a>&nbsp;(MSVR), while using <a href=\"https:\/\/en.wikipedia.org\/wiki\/Open-source_intelligence\">OSINT<\/a> to look for indications of that vulnerability being used in the wild. We did not find any indications of in-the-wild exploitation.<\/p>\n\n\n\n<p>The impact of heap-based buffer overflow ranges from simple DoS to full-fledged RCE. Although it\u2019s possible to allocate and free chunks through media metadata manipulation, performing the precise <a href=\"https:\/\/en.wikipedia.org\/wiki\/Heap_feng_shui\">heap-grooming<\/a> is not trivial in this case and attackers would need to chain the exploit with other vulnerabilities to successfully execute any arbitrary code. Given the potential impact of the vulnerability, coupled with the fact that it could be remotely triggered, it\u2019s a security risk that justifies the bug priority&nbsp;and how fast the fix was issued.<\/p>\n\n\n\n<p>We were impressed with the speed of <a href=\"https:\/\/chromium.googlesource.com\/chromiumos\/third_party\/adhd\/+\/abba3b27864aec87044c09f8ef314e7da895fc9c\/cras\/src\/server\/cras_bt_player.c\">the fix<\/a> and the effectiveness of the overall process. Within less than a week, the code was committed and, after several merges, made generally available to users. We thank the Google team and the Chromium community for their efforts in addressing the issue.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Improving security for all through research and threat intelligence sharing<\/h2>\n\n\n\n<p>As the threat and computing landscape continues to evolve, Microsoft strives to continuously improve security for all through research-driven protections and collaboration with customers, partners, and industry experts, regardless of the device or platform in use.<\/p>\n\n\n\n<p>To defend against the evolving threat landscape, organizations must closely monitor all devices and operating systems across platforms, including unmanaged devices. Unmanaged devices are sometimes ignored or missed by security teams at join time, making them attractive targets for compromising, quietly performing lateral movements, jumping network boundaries, and achieving persistence for the sake of launching broader attacks. <a href=\"https:\/\/docs.microsoft.com\/microsoft-365\/security\/defender-endpoint\/device-discovery?view=o365-worldwide\">Microsoft Defender for Endpoint&#8217;s device discovery capabilities<\/a> help organizations find certain unmanaged devices, including those running ChromeOS, and can detect if they are being operated by attackers when they start performing network interactions with servers and other managed devices.<\/p>\n\n\n\n<p>Microsoft security researchers continually work to discover new vulnerabilities and threats, turning knowledge of a variety of wide-reaching issues into improved solutions that protect users and organizations across platforms every single day. This case displays how vulnerability disclosures and threat intelligence sharing are essential to effectively mitigate issues and protect users against present and future threats. Moreover, by expanding upon our prior research, we can also continue to make positive contributions to the overall security of devices worldwide, even on platforms we currently don\u2019t directly support.<\/p>\n\n\n\n<p><strong>Jonathan Bar Or<\/strong><\/p>\n\n\n\n<p>Microsoft 365 Defender Research Team<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft discovered a memory corruption vulnerability in a ChromeOS component that could have been triggered remotely, allowing attackers to perform either a denial-of-service (DoS) or, in extreme cases, remote code execution (RCE).<\/p>\n","protected":false},"author":153,"featured_media":120401,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3663],"topic":[3687],"products":[],"threat-intelligence":[3739],"tags":[3917,3782],"coauthors":[3380],"class_list":["post-120374","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-research","topic-threat-intelligence","threat-intelligence-vulnerabilities-and-exploits","tag-adversary-in-the-middle","tag-linux"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Uncovering a ChromeOS remote memory corruption vulnerability | Microsoft Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Uncovering a ChromeOS remote memory corruption vulnerability | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"Microsoft discovered a memory corruption vulnerability in a ChromeOS component that could have been triggered remotely, allowing attackers to perform either a denial-of-service (DoS) or, in extreme cases, remote code execution (RCE).\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-19T21:38:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-10-13T14:16:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-vuln-social.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Microsoft Threat Intelligence\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-vuln-social.png\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft Threat Intelligence\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/microsoft-security-threat-intelligence\/\",\"@type\":\"Person\",\"@name\":\"Microsoft Threat Intelligence\"}],\"headline\":\"Uncovering a ChromeOS remote memory corruption vulnerability\",\"datePublished\":\"2022-08-19T21:38:06+00:00\",\"dateModified\":\"2023-10-13T14:16:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/\"},\"wordCount\":1841,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-Featured-Image.jpg\",\"keywords\":[\"Adversary-in-the-middle (AiTM)\",\"Linux\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/\",\"name\":\"Uncovering a ChromeOS remote memory corruption vulnerability | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-Featured-Image.jpg\",\"datePublished\":\"2022-08-19T21:38:06+00:00\",\"dateModified\":\"2023-10-13T14:16:37+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-Featured-Image.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-Featured-Image.jpg\",\"width\":1200,\"height\":800},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Uncovering a ChromeOS remote memory corruption vulnerability\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Uncovering a ChromeOS remote memory corruption vulnerability | Microsoft Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/","og_locale":"en_US","og_type":"article","og_title":"Uncovering a ChromeOS remote memory corruption vulnerability | Microsoft Security Blog","og_description":"Microsoft discovered a memory corruption vulnerability in a ChromeOS component that could have been triggered remotely, allowing attackers to perform either a denial-of-service (DoS) or, in extreme cases, remote code execution (RCE).","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/","og_site_name":"Microsoft Security Blog","article_published_time":"2022-08-19T21:38:06+00:00","article_modified_time":"2023-10-13T14:16:37+00:00","og_image":[{"width":1200,"height":600,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-vuln-social.png","type":"image\/png"}],"author":"Microsoft Threat Intelligence","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-vuln-social.png","twitter_misc":{"Written by":"Microsoft Threat Intelligence","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/microsoft-security-threat-intelligence\/","@type":"Person","@name":"Microsoft Threat Intelligence"}],"headline":"Uncovering a ChromeOS remote memory corruption vulnerability","datePublished":"2022-08-19T21:38:06+00:00","dateModified":"2023-10-13T14:16:37+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/"},"wordCount":1841,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-Featured-Image.jpg","keywords":["Adversary-in-the-middle (AiTM)","Linux"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/","name":"Uncovering a ChromeOS remote memory corruption vulnerability | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-Featured-Image.jpg","datePublished":"2022-08-19T21:38:06+00:00","dateModified":"2023-10-13T14:16:37+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-Featured-Image.jpg","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/08\/ChromeOS-Featured-Image.jpg","width":1200,"height":800},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/08\/19\/uncovering-a-chromeos-remote-memory-corruption-vulnerability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"Uncovering a ChromeOS remote memory corruption vulnerability"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/120374"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/153"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=120374"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/120374\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/120401"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=120374"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=120374"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=120374"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=120374"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=120374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=120374"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=120374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}