Google Chrome WebRTC 安全漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 2089294 漏洞类型 其他
发布时间 2020-08-01 更新时间 2020-08-01
CVE编号 CVE-2020-6514 CNNVD-ID CNNVD-202007-1004
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2020080005
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202007-1004
|漏洞详情
Google Chrome是美国谷歌(Google)公司的一款Web浏览器。WebRTC是其中的一个支持浏览器进行实时语音对话或视频对话的组件。 Google Chrome 84.0.4147.89之前版本中的WebRTC存在安全漏洞。攻击者可利用该漏洞绕过安全限制。
|漏洞EXP
WebRTC: usrsctp is called with pointer as network address

When usrsctp is used with a custom transport, an address must be provided to usrsctp_conninput be used as the source and destination address of the incoming packet. WebRTC uses the address of the SctpTransport instance for this value. Unfortunately, this value is often transmitted to the peer, for example to validate signing of the cookie. This could allow an attacker access to the location in memory of the SctpTransport of a peer, bypassing ASLR.

To reproduce, place the following code on line 9529 of sctp_output.c. This will output the peer's address to the log:

        struct sctp_state_cookie cookie2;
        struct sctp_state_cookie* cookie3;
  cookie3 = sctp_get_next_param(cookie, 4, &cookie2, sizeof(struct sctp_state_cookie));


  LOGE(\"COOKIE INITACK ADDRESS %llx laddress %llx\", *((long long*)cookie3->address), *((long long*)cookie3->address));

Or, view the SCTP packets sent by WebRTC before they are sent to the encryption layer. They are full of pointers. 

This bug is subject to a 90 day disclosure deadline. After 90 days elapse,
the bug report will become visible to the public. The scheduled disclosure
date is 2020-Jul-28. Disclosure at an earlier date is possible if
agreed upon by all parties.


Related CVE Numbers: CVE-2020-6514.



Found by: deadbeef@chromium.org

|参考资料

来源:chromereleases.googleblog.com

链接:https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html