Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google pushes emergency Chrome update to fix 8th zero-day in 2022

bleepingcomputer.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#21

Post by RadiozRadioz »

gus_massa wrote: post #18
tester756 wrote: post #4

Earlier quoted context omitted.

Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine. Moreover, we know that attackers weaponize and abuse these bugs as well; an analysis from Mozilla shows that over half of the “in the wild” Chrome exploits abused a JIT bu…

> As you see you can literally turn off JIT with a few clicks and make your browser way safer. Gmail takes forever to load in my machine. How much worse is the performance if I disable the JIT? x5?

I recommend switching Gmail to HTML mode[1]. I switched a few months ago, so much faster, never looked back.

[1]: https://support.google.com/mail/answer/15049?hl=en

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#22

Post by [deleted] »

superjan wrote: post #3

https://nvd.nist.gov/vuln/detail/CVE-2022-4135 “Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)”

[deleted]

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#23

Post by fancl20 »

tester756 wrote: post #4
ClosedPistachio wrote: post #2

Honest question: where do all of the new zero day vulnerabilities come from, new features/code? Just new bug detection techniques? I'd think over time entropy would get us to a point where there's hardly any vulnerabilities at all, but that's clearly not the case.

Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine. Moreover, we know that attackers weaponize and abuse these bugs as well; an analysis from Mozilla shows that over half of the “in the wild” Chrome exploits abused a JIT bu…

How Rust's memory safety can help to solve JIT generating bug code?

BTW Chromium is testing rewriting critical parts in Rust (https://chromium.googlesource.com/chromium/src/+/refs/heads/...)

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#24

Post by dekhn »

xpressvideoz wrote: post #14
masklinn wrote: post #11

Earlier quoted context omitted.

> new features/code? Note that new code which is not intrinsically buggy can expose a latent bug in some other place which hadn't been found until then. > Just new bug detection techniques? Or people (white or black hats) giving a new area a try, from time to time there's a seminal paper or attack on a domain which hadn't been much looked at previously, and turns out to be flush with targets.

> people (white or black hats) I've just realized that these terms may also be subject to the crazy "every word is racism" movement these days. shudders

I think that stopped a few years ago when people realized it wasn't reasonable.

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#25

Post by mk89 »

pjmlp wrote: post #6
ClosedPistachio wrote: post #2

Honest question: where do all of the new zero day vulnerabilities come from, new features/code? Just new bug detection techniques? I'd think over time entropy would get us to a point where there's hardly any vulnerabilities at all, but that's clearly not the case.

I don't know, C, C++, Objective-C, and everything else that might be copy-paste compatible with C semantics regarding strings, arrays, pointers and lack of bounds checking by default? Even if C++ and Objective-C are much better in that regard, as they offer bounds checked versions of those critical data stuctures, many devs just keep coding the good old ways, because performance trumps any attempt for security, until…

Do you know why/if a sanitizer is not enough to catch these bugs at runtime (and during their automated tests)?

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#26

Post by dopa42365 »

RadiozRadioz wrote: post #21
gus_massa wrote: post #18

Earlier quoted context omitted.

> As you see you can literally turn off JIT with a few clicks and make your browser way safer. Gmail takes forever to load in my machine. How much worse is the performance if I disable the JIT? x5?

I recommend switching Gmail to HTML mode[1]. I switched a few months ago, so much faster, never looked back. [1]: https://support.google.com/mail/answer/15049?hl=en

Or an email client of your choice? I don't even remember when I last checked my emails on a website.

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#27

Post by dmitriid »

ClosedPistachio wrote: post #2

Honest question: where do all of the new zero day vulnerabilities come from, new features/code? Just new bug detection techniques? I'd think over time entropy would get us to a point where there's hardly any vulnerabilities at all, but that's clearly not the case.

Chrome pushes hundreds of new APIs every year [1]. On top of that modern browsers are huge unmaintainable beasts. Chrome is upwards of 25 million lines of code [2]

All of this compounds together: new features introduce new bugs, new features and maintenance expose old bugs, all of those changes suddenly make new bugs appear because no one know all the intricacies of this code etc.

[1] https://web-confluence.appspot.com/#!/confluence

[2] https://www.openhub.net/p/chrome/analyses/latest/languages_s...

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#28

Post by [deleted] »

RadiozRadioz wrote: post #21
gus_massa wrote: post #18

Earlier quoted context omitted.

> As you see you can literally turn off JIT with a few clicks and make your browser way safer. Gmail takes forever to load in my machine. How much worse is the performance if I disable the JIT? x5?

I recommend switching Gmail to HTML mode[1]. I switched a few months ago, so much faster, never looked back. [1]: https://support.google.com/mail/answer/15049?hl=en

[deleted]

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#29

Post by svnpenn »

RadiozRadioz wrote: post #21
gus_massa wrote: post #18

Earlier quoted context omitted.

> As you see you can literally turn off JIT with a few clicks and make your browser way safer. Gmail takes forever to load in my machine. How much worse is the performance if I disable the JIT? x5?

I recommend switching Gmail to HTML mode[1]. I switched a few months ago, so much faster, never looked back. [1]: https://support.google.com/mail/answer/15049?hl=en

only works until you log out, then once you log in again, its back to shit mode

Re: Google pushes emergency Chrome update to fix 8th zero-day in 2022

#30

Post by saagarjha »

mk89 wrote: post #25
pjmlp wrote: post #6

Earlier quoted context omitted.

I don't know, C, C++, Objective-C, and everything else that might be copy-paste compatible with C semantics regarding strings, arrays, pointers and lack of bounds checking by default? Even if C++ and Objective-C are much better in that regard, as they offer bounds checked versions of those critical data stuctures, many devs just keep coding the good old ways, because performance trumps any attempt for security, until…

Do you know why/if a sanitizer is not enough to catch these bugs at runtime (and during their automated tests)?

Google invests heavily in sanitizers. It funded the development of the ones that ship with LLVM.
Post reply on HN