How can buffer overflows still be happening in this day and age?
[deleted]
Google assigns a CVE for libwebp and gives it a 10.0 score
21–30 of 235 posts
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#22The point about Android is particularly important. I wouldn't like to estimate the proportion of Android phones that are in regular use that no longer receive security updates.
I’m surprised, given the history of exploits, Google didn’t decide to start shipping the image decoders as an APEX system component in the Play Store, with the built-in ones serving as a fallback. They just might now.
Having spelunked through some Google announcements on this, it looks like they planned to do so back when Android 11 was in development (https://android-developers.googleblog.com/2020/02/Android-11... ), but I can’t find any evidence that image decoders are included in the current Android Mainline system updates that ship via Google Play - video codecs are, but not image ones apparently.
The image decoders are in android.graphics (https://developer.android.com/reference/android/graphics/pac... ) & that API subset is not listed in the Android Mainline system modules that are catalogued here: https://source.android.com/docs/core/ota/modular-system
It looks as if they planned to include image decoders, but that was dropped sometime during the Android 11 development cycle, unless I’ve missed something (which is certainly possible).
Edit: the final dev release announcement for Android 11 keeps the same paragraph about the native image decoder. So maybe it is there & I’m just not finding it? https://android-developers.googleblog.com/2020/09/android11-...
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#23Additional timeline info, as I was curious myself. WebP is old enough that a memory safe language was not a feasible option when the project started. Android 12 was the first version to support Rust code, and came out in 2021 [0, link talks about the first year of integration]. On the iOS side (which also was affected by this), Swift 1.0 came out in ~2014. As far as I can tell, Chrome doesn't yet support a memory saf…
Is JavaScript a memory safe language?
It is. and so is WASM, but both probably aren't fast enough
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#24Wow, Google really preferred a critical unfixable security flaw in Android sound like just an iOS zero day for over a week. Wonder why...
"Oops"
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#25So this could potentially be activated by opening up a WhatsApp or RCSChat that received a payload right? I'm turning off auto download for now
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#26Additional timeline info, as I was curious myself. WebP is old enough that a memory safe language was not a feasible option when the project started. Android 12 was the first version to support Rust code, and came out in 2021 [0, link talks about the first year of integration]. On the iOS side (which also was affected by this), Swift 1.0 came out in ~2014. As far as I can tell, Chrome doesn't yet support a memory saf…
Is JavaScript a memory safe language?
Yes, and so are Python, Lisp, Haskell, and a million other languages that were available in 2010.
None of those are suitable options for an image decoding library on the range of WebP supported platforms.
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#27The point about Android is particularly important. I wouldn't like to estimate the proportion of Android phones that are in regular use that no longer receive security updates.
Android phones don't have an awful lot of attack surface area for typical users though. Messenger apps already will refuse to display arbitrary images - Whatsapp for example will only display jpegs and mp4's sent from other contacts.
True, and most websites will reencode images for compression anyway. But the point still stands this makes "hacked by clicking a link" a reality again for some people which should have ended along with flash and java applets. The current mainstream is that "you won't get hacked if you don't install." (not to say that this is the best security practise..) Since you don't install images most people will just assume they are safe. I hope this whole ordeal doesn't hurt JPEG-XL adoption.
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#28Android is particularly troublesome here with the number of phones out there receiving no updates, and just a single download away from being exploited. For me, personally, it's a race to see if Google can get this patched for my Pixel 5 before security updates stop in October.
Based on Mishaal's post on Twitter (https://twitter.com/mishaalrahman/status/1705934521751806033), the patch will be in SPL released marked with 2023-10-06 date.
Pixel 5 should still qualifiy for it.
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#29Android is particularly troublesome here with the number of phones out there receiving no updates, and just a single download away from being exploited. For me, personally, it's a race to see if Google can get this patched for my Pixel 5 before security updates stop in October.
I just checked, and in the last 30 minutes a update has become available for my Pixel 5.
The security bulletin doesn't reference this CVE specifically but does mention a critical vulnerability that could lead to RCE.
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#30How can buffer overflows still be happening in this day and age?
Hubris and people thinking they can safely code in memory unsafe languages (they can't)