CVE-2022-4135 - Vulnerability Details - OpenCVE

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since Nov. 28, 2022.

Exploitation active

Automatable no

Technical Impact total

Vendors	Products
Google	Chrome
Microsoft	Edge Edge Chromium

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:a:microsoft:edge::::::::
	cpe:2.3:a:microsoft:edge_chromium::::::::

No data.

References

Link	Providers
https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html
https://crbug.com/1392715
https://security.gentoo.org/glsa/202305-10

History

Mon, 03 Feb 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2022-11-28'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2022-11-25T00:00:00.000Z

Updated: 2025-02-03T14:09:33.642Z

Reserved: 2022-11-24T00:00:00.000Z

Link: CVE-2022-4135

Vulnrichment

Updated: 2024-08-03T01:27:54.508Z

NVD

Status : Modified

Published: 2022-11-25T01:15:09.957

Modified: 2025-02-03T14:15:33.897

Link: CVE-2022-4135

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-4135", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "dateUpdated": "2025-02-03T14:09:33.642Z", "dateReserved": "2022-11-24T00:00:00.000Z", "datePublished": "2022-11-25T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2023-05-03T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)"}], "affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "unspecified", "lessThan": "107.0.5304.121", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html"}, {"url": "https://crbug.com/1392715"}, {"name": "GLSA-202305-10", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202305-10"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Heap buffer overflow"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:27:54.508Z"}, "title": "CVE Program Container", "references": [{"url": "https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html", "tags": ["x_transferred"]}, {"url": "https://crbug.com/1392715", "tags": ["x_transferred"]}, {"name": "GLSA-202305-10", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202305-10"}]}, {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-4135", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-15T14:45:12.315260Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-11-28", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-4135"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-03T14:09:33.642Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html", "tags": ["x_transferred"]}, {"url": "https://crbug.com/1392715", "tags": ["x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202305-10", "name": "GLSA-202305-10", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:27:54.508Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-4135", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-15T14:45:12.315260Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-11-28", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-4135"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-03T14:05:03.504Z"}}], "cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "107.0.5304.121", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html"}, {"url": "https://crbug.com/1392715"}, {"url": "https://security.gentoo.org/glsa/202305-10", "name": "GLSA-202305-10", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Heap buffer overflow"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2023-05-03T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-4135", "state": "PUBLISHED", "dateUpdated": "2025-02-03T14:09:33.642Z", "dateReserved": "2022-11-24T00:00:00.000Z", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "datePublished": "2022-11-25T00:00:00.000Z", "assignerShortName": "Chrome"}, "dataVersion": "5.1"}

{"cisaActionDue": "2022-12-19", "cisaExploitAdd": "2022-11-28", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Google Chromium GPU Heap Buffer Overflow Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "C33732EF-5591-4D37-9F31-8709B60F7D94", "versionEndExcluding": "107.0.5304.121", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*", "matchCriteriaId": "127CBA42-4C2A-4784-A112-53A1D5D7EF86", "versionEndExcluding": "107.0.1418.62", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*", "matchCriteriaId": "9058B624-3DB2-4552-B8E3-A54FD86F63B7", "versionEndExcluding": "107.0.5304.150", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)"}, {"lang": "es", "value": "El desbordamiento del b\u00fafer de mont\u00f3n en GPU en Google Chrome anterior a 107.0.5304.121 permiti\u00f3 a un atacante remoto que hab\u00eda comprometido el proceso de renderizado realizar potencialmente un escape de la zona de pruebas a trav\u00e9s de una p\u00e1gina HTML manipulada. (Severidad de seguridad de Chrome: alta)"}], "id": "CVE-2022-4135", "lastModified": "2025-02-03T14:15:33.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-11-25T01:15:09.957", "references": [{"source": "chrome-cve-admin@google.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html"}, {"source": "chrome-cve-admin@google.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://crbug.com/1392715"}, {"source": "chrome-cve-admin@google.com", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202305-10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking"], "url": "https://crbug.com/1392715"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202305-10"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}