What about CloudFlare ? Does this bring to question their decision to use V8 ?
Chrome 0day is being exploited now for CVE-2022-1096; update immediately
141–150 of 150 posts
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#142I would like to analyze the issue of browser security without controversy. The mitigations that Edge puts into practice (I'm talking about "Super Duper Secure" and "Enhanced Security") can prevent the operation of exploits in the V8 engine like this 0-day?
Is this platform dependent or the mitigation in progress works well? I mean for example some feature on mac and Linux is available out of the box asACG feature.
This analysis is very interesting because I have only read analisys related to privacy and not about security and integrity. (I mean compare between Chorme, Edge, Brave, etc ...)
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#143Is there a site/service/mailing list that provides notifications for critical/RCE/in-the-wild exploit patches? Keeping every piece of software you run up-to-date takes a lot of work, and something like that would help with knowing what to prioritize.
I subscribe to debian and openbsd security advisory email lists, which works for me generally to know what is going on in the space(s) I care more about:
https://lists.debian.org/debian-security-announce/ (this one covers security updates to many packages, but not as much as CVE advisories cover, windows, etc)
https://www.debian.org/security/
https://www.openbsd.org/mail.html (ctrl-f for security, but unlike the debian ones, this only covers patches to the base OS, not other packages).
But for you of course it would depend on what you run and what matters to you.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#144> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…
I like that in chrome one can turn off javascript and images by default, then re-enable it for select sites only, or leave a tab open to re-enable it temporarily only.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#145Earlier quoted context omitted.
Where are these and why are they not being exploited then?
Because they were discovered by security researchers and patched by Microsoft. Google around for Azure security vulnerability and enjoy the horror.
I'm assuming all cloud providers have vulnerabilities discovered, reported and patched all the time, as it happens in any complex set of software.
Do you have any link where the cloud providers are compared to show that Azure in particular has a higher rate or are you just making unfounded speculations?
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#146Earlier quoted context omitted.
I've been in the security field a while, what exactly do you mean by provably secure?
probably a JS engine with guarantee through formal methods that sandbox escapes are impossible. for a JIT engine, this might mean asserting that control flow inside generated code never leaves it, and only accesses pages allocated to it. these obligations would also need to be carried through to standard library implementations. i.e. probably secure analogously to how seL4 is provably secure. this would be infeasible…
I wish we could and I think we should.
I'm just very sad we don't have safe hardware w.r.t. memory corruption via rowhammer and I don't think any of the typical formal methods or seL4 account for it. Safely running untrusted code is nearly impossible on modern computers.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#147Earlier quoted context omitted.
Because they were discovered by security researchers and patched by Microsoft. Google around for Azure security vulnerability and enjoy the horror.
I'm assuming all cloud providers have vulnerabilities discovered, reported and patched all the time, as it happens in any complex set of software. Do you have any link where the cloud providers are compared to show that Azure in particular has a higher rate or are you just making unfounded speculations?
https://arstechnica.com/information-technology/2021/09/secur...
Is a good starting point. No other big cloud provider has had vulnerabilities that allow crossing the tenant barrier, and Azure has had two of them. If you read the details, both of them are simply unacceptable - especially the second one is trivial and shouldn't have passed any sort of security review.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#148Anyone know if qutebrowser is affected?
See https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebro... - it seems to be, unfortunately.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#149Earlier quoted context omitted.
Thanks, I didn't think about that.
I'm not saying it -isn't- in there, just that it's not 100% chance it's there. I don't think the exact "failure" has been cited yet. Would be good to check qute-browser webpage or qtwebengine page rather than a random HN asshole like me :D
See https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebro... - it seems to be, unfortunately.
Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately
#150Looks like these are the two commits, based on the issue number: https://github.com/v8/v8/commit/0981e91a4f8692af337e2588562a... https://github.com/v8/v8/commit/a2cae2180a7a6d64ccdede44d730... Although there could be others.
From those commits, would you say this is RCE vulnerability taking advantage of memory/stack callbacks?
Does this mean an attacker may exploit this vulnerability to compromise an entire system?