CVE-2024-5159 - Understanding the Heap Buffer Overflow in ANGLE (Google Chrome), with Code Sample and Exploit Explanation

CVE-2024-5159 is a high-severity vulnerability affecting Google Chrome, specifically in the ANGLE graphics layer. ANGLE (Almost Native Graphics Layer Engine) is the library Chrome uses to translate WebGL and other OpenGL calls to Vulkan, Direct3D, or Metal on various platforms. This bug exists in Chrome versions before 125..6422.76.

A remote attacker can exploit this heap buffer overflow vulnerability by tricking a user into visiting a specially crafted HTML page. This can lead to out-of-bounds memory reads—meaning the attacker can read memory they're not supposed to, potentially leaking sensitive information from the browser’s memory.

1. The Vulnerability

A heap buffer overflow happens when a program writes (or reads) more data to a heap-allocated buffer than it was allocated for. In CVE-2024-5159, the problem specifically allows *reading* out-of-bounds, which could return private information from elsewhere in the app’s memory.

This issue was found in ANGLE, which processes image and buffer data for the browser. By submitting a crafted WebGL or HTML page, an attacker could trigger this bug.

2. Code Snippet Illustrating the Issue

Here's a simplified, high-level snippet to demonstrate what might go wrong. (This is NOT the original Chrome source code! This is a simulated example for educational purposes.)

// Hypothetical affected code in ANGLE:
void processInputData(unsigned char *input, size_t length) {
    unsigned char buffer[128];
    memcpy(buffer, input, length); // BAD: length is not checked!
    // Now buffer can contain overflowed data.
}

If an attacker provides an input with length > 128, this code will read out-of-bounds memory, returning whatever is after the allocated buffer. Chrome’s rendering process could later send this back to the attacker or crash.

In reality, the actual CVE involves more complex code and deeper use of GPU memory buffers, but the pattern is the same: untrusted data length is not properly checked, and this overflows the buffer.

Trigger Vulnerable ANGLE Path

The page calls specific WebGL methods or creates image data that, when processed, will cause the out-of-bounds read due to the internal buffer not being large enough.

Steal Data or Cause Crash

The attacker may attempt to retrieve memory from the process by reading back buffers, or induce a crash revealing memory layouts or data left in the heap.

*Example Proof-of-Concept (POC) attack (simplified):*

<script>
let canvas = document.createElement('canvas');
let gl = canvas.getContext('webgl');
let attackBuffer = new Uint8Array(1024);
for (let i = ; i < attackBuffer.length; ++i) {
    attackBuffer[i] = x41; // Fill with 'A'
}
// This call could reach the vulnerable code if the length is unchecked in ANGLE
gl.texImage2D(gl.TEXTURE_2D, , gl.RGBA, 16, 16, , gl.RGBA, gl.UNSIGNED_BYTE, attackBuffer);
</script>

This script creates a WebGL canvas and attempts to upload more data than expected. If Chrome’s ANGLE library did not check the buffer length, it could read (possibly leak) adjacent memory from the heap.

Mitigation & Fix

Google has patched this vulnerability in Chrome version 125..6422.76 and later.
If you’re using Chrome, check your version and update immediately:

On desktop, go to "Help" → "About Google Chrome".

- For the latest security notes: Chrome Security Updates

More Information & References

- Google Chrome Release Notes - May 2024
- Chromium Issue Tracker, CVE-2024-5159 (May be restricted)
- ANGLE Project (Official Source)
- Official CVE Entry

CVE-2024-5159 is a heap buffer overflow in the ANGLE library, used by Chrome for WebGL.

- Older Chrome versions (prior to 125..6422.76) are vulnerable to crafted web pages performing out-of-bounds memory reads.

Attackers could steal sensitive browser data this way until fixed.

Stay up-to-date with your browser, and always download Chrome updates when prompted!

Timeline

Published on: 05/22/2024 16:15:11 UTC
Last modified on: 08/01/2024 21:03:10 UTC