CVE-2022-3038

Google Chromium Network Service Use-After-Free Vulnerability

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

Act

*SSVC

Descriptions

Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Un uso de memoria previamente liberada en Network Service en Google Chrome versiones anteriores a 105.0.5195.52, permitía a un atacante remoto explotar potencialmente una corrupción de pila por medio de una página HTML diseñada.

Google Chrome version 103.0.5060.53 (Official Build) and Chromium version 105.0.5148.0 (Developer Build) (64-bit) suffer from a network::URLLoader::NotifyCompleted heap use-after-free vulnerability.

Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

*Credits: N/A

CVSS Scores

NISTv3.1 8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Act

Exploitation

Active

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2022-08-30 CVE Reserved
2022-09-26 CVE Published
2023-03-30 Exploited in Wild
2023-04-20 KEV Due Date
2024-08-03 CVE Updated
2024-08-03 First Exploit
2024-11-05 EPSS Updated

CWE

CWE-416: Use After Free

CAPEC

References (5)

URL	Tag	Source
http://packetstormsecurity.com/files/168596/Google-Chrome-103.0.5060.53-network-URLLoader-NotifyCompleted-Heap-Use-After-Free.html	Third Party Advisory

URL	Date	SRC
https://crbug.com/1340253	2024-08-03

URL	Date	SRC

URL	Date	SRC
https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html	2024-07-03
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE	2024-07-03
https://security.gentoo.org/glsa/202209-23	2024-07-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				< 105.0.5195.52 Search vendor "Google" for product "Chrome" and version " < 105.0.5195.52"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				37 Search vendor "Fedoraproject" for product "Fedora" and version "37"		-		Affected