Cybersecurity
_ _ tazz_ 0 Comments

Incomplete disclosures by Apple and Google create “huge blindspot” for 0-day hunters

Incomplete disclosures by Apple and Google create “huge blindspot” for 0-day hunters
Enlarge
Getty Images

Incomplete information included in recent disclosures by Apple and Google reporting critical zero-day vulnerabilities under active exploitation in their products has created a “huge blindspot” that’s causing a large number of offerings from other developers to go unpatched, researchers said Thursday.

Two weeks ago, Apple reported that threat actors were actively exploiting a critical vulnerability in iOS so they could install espionage spyware known as Pegasus. The attacks used a zero-click method, meaning they required no interaction on the part of targets. Simply receiving a call or text on an iPhone was enough to become infected by the Pegasus, which is among the world’s most advanced pieces of known malware.

“Huge blindspot”

Apple said the vulnerability, tracked as CVE-2023-41064, stemmed from a buffer overflow bug in ImageIO, a proprietary framework that allows applications to read and write most image file formats, which include one known as WebP. Apple credited the discovery of the zero-day to Citizen Lab, a research group at the University of Toronto’s Munk School that follows attacks by nation-states targeting dissidents and other at-risk groups.

Four days later, Google reported a critical vulnerability in its Chrome browser. The company said the vulnerability was what’s known as a heap buffer overflow that was present in WebP. Google went on to warn that an exploit for the vulnerability existed in the wild. Google said that the vulnerability, designated as CVE-2023-4863, was reported by the Apple Security Engineering and Architecture team and Citizen Lab.

Speculation, including from me, quickly arose that a large number of similarities strongly suggested that the underlying bug for both vulnerabilities was the same. On Thursday, researchers from security firm Rezillion published evidence that they said made it “highly likely” both indeed stemmed from the same bug, specifically in libwebp, the code library that apps, operating systems, and other code libraries incorporate to process WebP images.

Rather than Apple, Google, and Citizen Lab coordinating and accurately reporting the common origin of the vulnerability, they chose to use a separate CVE designation, the researchers said. The researchers concluded that “millions of different applications” would remain vulnerable until they, too, incorporated the libwebp fix. That, in turn, they said, was preventing automated systems that developers use to track known vulnerabilities in their offerings from detecting a critical vulnerability that’s under active exploitation.

“Since the vulnerability is scoped under the overarching product containing the vulnerable dependency, the vulnerability will only be flagged by vulnerability scanners for these specific products,” Rezillion researchers Ofri Ouzan and Yotam Perkal wrote. “This creates a HUGE blindspot for organizations blindly relying on the output of their vulnerability scanner.”

Google has further come under criticism for limiting the scope of CVE-2023-4863 to Chrome rather than in libwebp. Further, the official description describes the vulnerability as a heap buffer overflow in WebP in Google Chrome.

In an email, a Google representative wrote: “Many platforms implement WebP differently. We do not have any details about how the bug impacts other products. Our focus was getting a fix out to the Chromium community and affected Chromium users as soon as possible. It is best practice for software products to track upstream libraries they depend on in order to pick up security fixes and improvements.”

The representative noted that the WebP image format is mentioned in its disclosure and the official CVE page. The representative didn’t explain why the official CVE and Google’s disclosure did not mention the widely used libwebp library or that other software was also likely to be vulnerable.

The Google representative didn’t answer a question asking if CVE-2023-4863 and CVE-2023-41064 stemmed from the same vulnerability. Citizen Lab and Apple didn’t respond to emailed questions before this story went live.

So, who’s affected?

The number of apps, frameworks, code libraries, and other packages that incorporate libwebp and have yet to receive a patch is unknown. While Microsoft patched CVE-2023-4863 in its Edge browser, the company confirmed in an email on Thursday that other vulnerable products and code packages had yet to be patched. An update for the affected offerings “are in our release pipeline,” the representative said, without providing an estimated release. Microsoft offerings known to remain vulnerable are Teams, a widely used collaboration platform, and the developer tool Visual Studio Code.

Both products are built on the Electron framework, which was also affected by CVE-2023-4863. There is a large number of other apps that also use Electron. According to a list compiled on Wikipedia, they include:

  • 1Password
  • balenaEtcher
  • Basecamp 3
  • Beaker (web browser)
  • Bitwarden
  • CrashPlan
  • Cryptocat (discontinued)
  • Discord
  • Eclipse Theia
  • FreeTube
  • GitHub Desktop
  • GitKraken
  • Joplin
  • Keybase
  • Lbry
  • Light Table
  • Logitech Options +
  • LosslessCut
  • Mattermost
  • Microsoft Teams
  • MongoDB Compass
  • Mullvad
  • Notion
  • Obsidian
  • QQ (for macOS)
  • Quasar Framework
  • Shift
  • Signal
  • Skype
  • Slack
  • Symphony Chat
  • Tabby
  • Termius
  • TIDAL
  • Twitch
  • Visual Studio Code
  • WebTorrent
  • Wire
  • Yammer

Further adding to the list of vulnerable apps, other widely used frameworks, code libraries, and OSes are also vulnerable to CVE-2023-4863 because they also incorporate Electron, another code library that uses libwebp, or have libwebp built in directly. Fortunately, many of them have been patched against the vulnerability, including:

  • Google Chrome –  Mac and Linux 116.0.5845.187 and Windows 116.0.5845.187/.188.
  • Mozilla – Firefox 117.0.1, Firefox ESR 115.2.1, Firefox ESR 102.15.1, Thunderbird 102.15.1, and Thunderbird 115.2.2
  • Brave Browser – version 1.57.64 (Chromium: 116.0.5845.188).
  • Microsoft Edge – versions 109.0.1518.140, 116.0.1938.81 and 117.0.2045.31.
  • Tor Browser – version 12.5.4.
  • Opera – version 102.0.4880.46.
  • Vivaldi – version 6.2.3105.47.
  • Bitwarden

Operating systems

  • Debian – released partial security fixes for chromium, firefox, firefox-esr, libwebp, and thunderbird; not all distributions have a fix.
  • Ubuntu – released partial security fixes for chromium-browser, libwebp, firefox, thunderbird, and mozjs; not all distributions have a fix.
  • Alpine – released security fixes to chromium, libwebp, qt5-qtimageformats, and firefox-esr.
  • Gentoo – released security fix to media-libs/libwebp version 1.3.1_p20230908.
  • RedHat – released security fixes (RHSA) for Mozilla Thunderbird, Mozilla Firefox, and libwebp.
  • SUSE – released security fixes (SUSE-SU and openSUSE-SU) for Mozilla Firefox, Mozilla Thunderbird, libwebp, and chromium packages.
  • Oracle – released security fixes (ELSA) for Mozilla Firefox and Mozilla Thunderbird.
  • Amazon Linux – still haven’t pushed fixes to their AMI images.

Other software

Other software known to be patched is:

  • Slack
  • 1Password
  • Telegram

The number of affected software packages is too large to check all of them. People who want to know about a specific offering not listed should check with the developer.

Beware of false negatives

Rezillion went on to say that a scan of Apple’s ImageIO binaries showed not only that it used libwebp, but also that it referenced vp8l_dec.c, vp8li_dec.h, huffman_utils.c, and huffman_utils.h. Those are the same files present in libwebp that caused CVE-2023-4863.

Without comment from Citizen Lab and Apple, it’s impossible to confirm precisely what the relationship is between CVE-2023-4863, reported by Google disclosure, and CVE-2023-41064, reported by Apple. (CVE is short for common vulnerabilities and exposures.) The entire point of the CVE system is to identify the origin of a vulnerability so anyone making or using software downstream from the origin can easily tell if they’re vulnerable.

If the CVEs cover the same underlying vulnerability, the teams involved in its discovery should have coordinated and made that clear. Google’s omission of libwebp in the CVE it reported only compounded the lack of completeness. The Rezillion researchers said the breakdown puts an entire ecosystem at risk because many developers use automated scanners that compile an SBOM (software bill of materials) to track any vulnerable components in the apps they maintain.

The researchers said the incomplete disclosures present a “formidable undertaking” for developers trying to determine if their wares are vulnerable. They said the lack of clarity also puts the developers at risk of receiving false negatives when looking for vulnerabilities. The researchers wrote:

While the vulnerability initially seems to target Chromium-based applications, now that we know better, we understand that it possesses the potential to affect a much wider range of software and applications relying on the ubiquitous libwebp package for WebP codec functionality. This package stands out for its efficiency, outperforming JPEG and PNG in terms of size and speed. Consequently, a multitude of software, applications, and packages have adopted this library, or even adopted packages that libwebp is their dependency, creating a complex challenge when attempting to identify vulnerable systems. The sheer prevalence of libwebp extends the attack surface significantly, raising serious concerns for both users and organizations.

Organizations with SBOM solutions in their environment are advised to query the SBOM for any package using a vulnerable version of libwebp as a dependency. It is especially important to make sure that the system libwebp library is patched as several applications such as chromium for example, are built against the system libwebp library.

The plain English used in the Apple and Google disclosures and the official CVEs that resulted gave readers good reason to think the zero-days were distinct and limited to only a handful of products. Now that we know better, developers and end users should scrutinize software carefully. If it interacts in any way with WebP images, it very likely needs to be patched before it’s safe to use.

♥1