PT-2022-2401 · Google+2 · Google Chrome+3

Khalil Zhani · Published 2022-04-27 · Updated 2024-06-15 · CVE-2022-1489

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 101.0.4951.41 Lacros versions prior to 101.0.4951.41

Description The issue is related to out of bounds memory access in the UI Shelf component of Google Chrome on Chrome OS. This could allow a remote attacker to potentially exploit heap corruption via specific user interactions, leading to a program crash.

Recommendations For Google Chrome versions prior to 101.0.4951.41, update to version 101.0.4951.41 or later. For Lacros versions prior to 101.0.4951.41, update to version 101.0.4951.41 or later.

Exploit

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

ALT-PU-2022-1777

ALT-PU-2022-1822

ALT-PU-2022-1828

ALT-PU-2022-2055

BDU:2022-02771

CVE-2022-1489

DSA-5125-1

MGASA-2022-0158

OPENSUSE-SU-2022:0125-1

OPENSUSE-SU-2024:12046-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Lacros

References · 2333

• 🔥 https://crbug.com/1300561 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-1489 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-1489 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0158.html · Security Note
• https://cve.org/CVERecord?id=CVE-2022-1489 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-1489 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1489 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1489 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5125-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html · Vendor Advisory
• https://security.gentoo.org/glsa/202208-25 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02771 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12046-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0125-1 · Vendor Advisory