Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google pushes emergency Chrome update to fix 8th zero-day in 2022

bleepingcomputer.com

Post reply on HN
Print view View original

11–20 of 51 posts

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#11

Post by masklinn »

ClosedPistachio wrote: post #2

Honest question: where do all of the new zero day vulnerabilities come from, new features/code? Just new bug detection techniques? I'd think over time entropy would get us to a point where there's hardly any vulnerabilities at all, but that's clearly not the case.

> new features/code?

Note that new code which is not intrinsically buggy can expose a latent bug in some other place which hadn't been found until then.

> Just new bug detection techniques?

Or people (white or black hats) giving a new area a try, from time to time there's a seminal paper or attack on a domain which hadn't been much looked at previously, and turns out to be flush with targets.

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#12

Post by shp0ngle »

tester756 wrote: post #4
ClosedPistachio wrote: post #2

Honest question: where do all of the new zero day vulnerabilities come from, new features/code? Just new bug detection techniques? I'd think over time entropy would get us to a point where there's hardly any vulnerabilities at all, but that's clearly not the case.

Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine. Moreover, we know that attackers weaponize and abuse these bugs as well; an analysis from Mozilla shows that over half of the “in the wild” Chrome exploits abused a JIT bu…

Chrome code size is giant, it's hard to "just" rewrite it to Rust.

There seem to be some experiments with adding Rust code slowly, but there seem to be some interop issues.

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#13

Post by masklinn »

muststopmyths wrote: post #10

I’m confused. If it’s a “heap buffer overflow in the GPU”, does this fix the chrome path to exploit and leave the driver for the manufacturer to patch ? Or perhaps the bug is not actually “in the gpu “ ?

It could be in a GPU kernel no?

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#14

Post by xpressvideoz »

masklinn wrote: post #11
ClosedPistachio wrote: post #2

Honest question: where do all of the new zero day vulnerabilities come from, new features/code? Just new bug detection techniques? I'd think over time entropy would get us to a point where there's hardly any vulnerabilities at all, but that's clearly not the case.

> new features/code? Note that new code which is not intrinsically buggy can expose a latent bug in some other place which hadn't been found until then. > Just new bug detection techniques? Or people (white or black hats) giving a new area a try, from time to time there's a seminal paper or attack on a domain which hadn't been much looked at previously, and turns out to be flush with targets.

> people (white or black hats)

I've just realized that these terms may also be subject to the crazy "every word is racism" movement these days. shudders

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#15

Post by rippercushions »

xpressvideoz wrote: post #14
masklinn wrote: post #11

Earlier quoted context omitted.

> new features/code? Note that new code which is not intrinsically buggy can expose a latent bug in some other place which hadn't been found until then. > Just new bug detection techniques? Or people (white or black hats) giving a new area a try, from time to time there's a seminal paper or attack on a domain which hadn't been much looked at previously, and turns out to be flush with targets.

> people (white or black hats) I've just realized that these terms may also be subject to the crazy "every word is racism" movement these days. shudders

Allowhats and denyhats? Or maybe defenderhats and exploiterhats.

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#16

Post by eska »

muststopmyths wrote: post #10

I’m confused. If it’s a “heap buffer overflow in the GPU”, does this fix the chrome path to exploit and leave the driver for the manufacturer to patch ? Or perhaps the bug is not actually “in the gpu “ ?

Oftentimes users of the GPU have to sanitize the data and commands sent to the GPU driver because it makes harsh assumptions about the inputs being legal. In that case the bug is on the application side because an unsafe API was used with arbitrary user input.

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#17

Post by gilrain »

xpressvideoz wrote: post #14
masklinn wrote: post #11

Earlier quoted context omitted.

> new features/code? Note that new code which is not intrinsically buggy can expose a latent bug in some other place which hadn't been found until then. > Just new bug detection techniques? Or people (white or black hats) giving a new area a try, from time to time there's a seminal paper or attack on a domain which hadn't been much looked at previously, and turns out to be flush with targets.

> people (white or black hats) I've just realized that these terms may also be subject to the crazy "every word is racism" movement these days. shudders

I also disapprove of the irrational behavior I imagine might exist, potentially.

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#18

Post by gus_massa »

tester756 wrote: post #4
ClosedPistachio wrote: post #2

Honest question: where do all of the new zero day vulnerabilities come from, new features/code? Just new bug detection techniques? I'd think over time entropy would get us to a point where there's hardly any vulnerabilities at all, but that's clearly not the case.

Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine. Moreover, we know that attackers weaponize and abuse these bugs as well; an analysis from Mozilla shows that over half of the “in the wild” Chrome exploits abused a JIT bu…

> As you see you can literally turn off JIT with a few clicks and make your browser way safer.

Gmail takes forever to load in my machine. How much worse is the performance if I disable the JIT? x5?

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#19

Post by edwnj »

tester756 wrote: post #4
ClosedPistachio wrote: post #2

Honest question: where do all of the new zero day vulnerabilities come from, new features/code? Just new bug detection techniques? I'd think over time entropy would get us to a point where there's hardly any vulnerabilities at all, but that's clearly not the case.

Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine. Moreover, we know that attackers weaponize and abuse these bugs as well; an analysis from Mozilla shows that over half of the “in the wild” Chrome exploits abused a JIT bu…

A lot of criticisms on the way Mozilla was managed over the past few years, especially in terms of investments.. I think what they've done with rust hands down makes up for all it and more.

That language has the potential to really change the entire landscape.

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#20

Post by greenthrow »

gus_massa wrote: post #18
tester756 wrote: post #4

Earlier quoted context omitted.

Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine. Moreover, we know that attackers weaponize and abuse these bugs as well; an analysis from Mozilla shows that over half of the “in the wild” Chrome exploits abused a JIT bu…

> As you see you can literally turn off JIT with a few clicks and make your browser way safer. Gmail takes forever to load in my machine. How much worse is the performance if I disable the JIT? x5?

No. Gmail is likely slow to load because it's loading, not because of code execution time. Disabling JIT doesn't make much difference for most users most od the time.

Protip: archive your inbox regulaely to improve gmail load time.

Post reply on HN