PT-2024-13256 · Google · Chromium-Browser

Andrea Palanca · Published 2024-03-05 · Updated 2024-03-05 · CVE-2023-45592

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AiLux imx6 bundle versions prior to imx6 1.0.7-2

Description A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser exacerbates the impacts of successful attacks executed against the browser. This issue is due to the binary being executed with the “--no-sandbox” option and with root privileges.

Recommendations For AiLux imx6 bundle versions prior to imx6 1.0.7-2, update to version imx6 1.0.7-2 or later to resolve the issue. As a temporary workaround, consider disabling the execution of the Chromium browser with the “--no-sandbox” option and root privileges until a patch is available. Restrict access to the embedded Chromium browser to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2023-45592

Affected Products

Chromium-Browser

References · 6

• https://osv.dev/vulnerability/CVE-2023-45592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45592 · Security Note
• https://t.me/cvenotify/73003 · Telegram Post
• https://twitter.com/CVEnew/status/1764978592264384624 · Twitter Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2023-45592 · Note
• https://twitter.com/VulmonFeeds/status/1765008645496902003 · Twitter Post