Google Zero-Day Vulnerability: 5th Exploit Patched

Wajahat Raja

October 9, 2023 - TuxCare expert team

Google recently made waves in the cybersecurity world by quickly resolving a new zero-day vulnerability aggressively exploited in its Chrome browser. This is the fifth zero-day vulnerability that Google has discovered and patched in the field this year. In this blog, we’ll go into the intricacies of the current Google Zero-Day Vulnerability and consider the ramifications for both individual users and businesses.

Understanding CVE-2023-5217

CVE-2023-5217 is characterized as a heap buffer overflow within the libvpx free codec library, specifically related to vp8 encoding. This technical jargon effectively implies that there is a bug in the code that handles video encoding in a library that Chrome uses. Clément Lecigne, a member of Google’s Threat Analysis Group, is credited with finding this vulnerability as a part of Google security measures.

Such buffer overflow concerns can cause program crashes or, more importantly, allow malicious actors to execute arbitrary code on targeted systems. This puts both system availability and data integrity at risk.

Google Zero-Day Vulnerability – Exploitation and Consequences

Another Google Threat Analysis Group researcher, Maddie Stone, claimed on social media that this zero-day vulnerability had been exploited by a commercial spyware vendor, who was exploiting it to target high-risk users. While the phrase “commercial spyware vendor” raises eyebrows, it’s worth noting that Google did not directly indicate a link between CVE-2023-5217 and Pegasus, a notorious tool for targeted assaults.

Callie Guenther, a senior manager specializing in cyber threat research at Critical Start, stressed that establishing a direct relationship between Pegasus and CVE-2023-5217 remains difficult in the absence of concrete data.

Continual Targeting of Popular Products

The recent zero-day finding comes just after new cybersecurity updates from Google that disclosed CVE-2023-5129, a severe vulnerability in the libwebp image library. This issue, which is currently considered a duplicate of CVE-2023-4863, affects how images are processed and allows attackers to potentially execute arbitrary code on susceptible systems.

Guenther reported that this vulnerability has a broad attack surface and was assigned a high severity rating of 10.0 by Google and 8.8 by the NIST (National Institute of Standards and Technology). Security experts have linked it to the BLASTPASS zero-click iMessage attack chain, which has been used to install the NSO Group’s Pegasus spyware on hacked iPhones. Zero-day vulnerability prevention has thus become an important topic in the cybersecurity landscape.

Heightened Activity in Google Vulnerabilities

Callie Guenther pointed out the current increase in zero-day vulnerabilities impacting Google software. Given the ongoing efforts by threat actors to attack popular software, she emphasized the necessity of remaining vigilant and applying patches as soon as possible. The discovery of CVE-2023-5217 fits into this trend, in which threat actors are constantly looking for vulnerabilities to exploit for malicious objectives.

Similarities with CVE-2023-5129

CVE-2023-5217 is related to CVE-2023-5129 (also known as 4863). Both are heap buffer overflow vulnerabilities, however, they affect separate libraries related to visual media rendering. While CVE-2023-5129 affected the libwebp image processing library, CVE-2023-5217 affects the libvpx video encoding library.

Tanium’s Melissa Bischoping, Director of Endpoint Security Research, stressed that the attribution of these vulnerabilities may not affect the urgency of patching. Threat actors can adopt and reuse vulnerabilities, making timely patching and zero-day vulnerability remediation an absolute requirement.

Expanding Impact Beyond Chrome

Ashley Leonard, Founder and CEO of Syxsense, highlighted an important feature of CVE-2023-5129. This issue, which was formerly assumed to be unique to Google Chrome, has now been classed as a fault in libwebp. This is noteworthy since libwebp is used by a variety of programs and platforms other than Chrome. Notably, it extends its reach to Chromium-based browsers such as Mozilla Firefox, Apple Safari, and Microsoft Edge, which all use libwebp for greater image compression and faster loading.

Conclusion

Finally, Google’s rapid patching efforts to CVE-2023-5217, the year’s fifth actively exploited zero-day vulnerability, highlight the continued challenges in the cybersecurity landscape. It also necessitates why swift action is important in the latest zero-day exploit mitigation. As threat actors continue to attempt to target popular software, it is critical for individuals and organizations to be cautious and apply patches as soon as possible.

The similarities with past vulnerabilities show the significance of proactive security measures, regardless of the vulnerability’s origins or attribution. Furthermore, CVE-2023-5129’s broader impact serves as a sharp reminder of the linked nature of software libraries and the need for comprehensive security measures across several platforms and applications.

Stay informed, and stay safe.

The sources for this piece include articles in Bleeping Computer and TechCrunch.

Summary