Quantum Secular Labs / Blog / Advisories

CVE-2016-5202: Google Chrome: Incorrect Permission Assignment for Critical Resource

CVE-2016-5202 is rated critical with a CVSS v3.1 base score of 9.1 and affects Google Chrome. Per its scoring, it can be exploited over the network, without authentication, without any user interaction.

Vulnerability description

browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy.

Severity breakdown

CVSS v3.1 9.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

• Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
• Attack complexity: Low. No special conditions; the attack can be repeated reliably.
• Privileges required: None. No account or prior access is needed.
• User interaction: None. No action from any user is needed.
• Scope: Unchanged. Impact stays within the vulnerable component.
• Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
• Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
• Availability impact: None. No effect on availability.

Underlying weakness

CWE-732: Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Affected products

• Google Chrome: before 54.0.2840.98; before 54.0.2840.99; before 54.0.2840.100

References

• http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00029.html
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5202
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-5202
• https://security-tracker.debian.org/tracker/CVE-2016-5202