PT-2022-6785 · Google+1 · Google Chrome+1

Youssef Sammouda · Published 2022-01-04 · Updated 2023-08-12 · CVE-2022-4925

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 97.0.4692.71

Description The issue is related to insufficient validation of untrusted input in the QUIC protocol implementation in Google Chrome. This can be exploited by a remote attacker to perform header splitting via malicious network traffic, potentially affecting the integrity of protected information.

Recommendations For versions prior to 97.0.4692.71, update to version 97.0.4692.71 or later to resolve the issue. As a temporary workaround, consider restricting the use of the QUIC protocol until a patch is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-04677

CVE-2022-4925

DSA-5046-1

Affected Products

Astra Linux

Google Chrome

References · 14

• 🔥 https://github.com/ZeusBox/CVE-2021-37980 · Exploit
• 🔥 https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003 · Exploit
• 🔥 https://github.com/Peterpan0927/TFC-Chrome-v8-bug-CVE-2021-38001-poc · Exploit
• 🔥 https://github.com/maldiohead/TFC-Chrome-v8-bug-CVE-2021-38001-poc · Exploit
• 🔥 https://crbug.com/1238309 · Exploit
• https://osv.dev/vulnerability/CVE-2022-4925 · Vendor Advisory
• https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5046-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4925 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4925 · Security Note
• https://bdu.fstec.ru/vul/2023-04677 · Security Note
• https://t.me/cibsecurity/67405 · Telegram Post