CVE-2022-0609: Use after free in Animation

CVE-2022-0609 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2022-02-22

A use-after-free vulnerability exists in the Animation component of Google Chromium. A remote attacker can exploit this via a specially crafted HTML page to cause heap corruption, potentially leading to arbitrary code execution.

Technologies: CefSharp.Common (NuGet), CefSharp.Common.NETCore (NuGet), CefSharp.WinForms (NuGet), CefSharp.Wpf (NuGet), CefSharp.Wpf.HwndHost (NuGet). Vendors: Google, NuGet.

Quick answers

Is CVE-2022-0609 exploited in the wild?
Yes. CVE-2022-0609 is known to be exploited in the wild, first recorded on 15 February 2022. Treat it as urgent.
How severe is CVE-2022-0609?
Critical severity, with a CVSS score of 3.1, published 22 February 2022.
Which products and versions are affected?
CefSharp.Common (NuGet) ECOSYSTEM:introduced=0,fixed=98.1.210; CefSharp.Common.NETCore (NuGet) ECOSYSTEM:introduced=0,fixed=98.1.210; CefSharp.OffScreen (NuGet) ECOSYSTEM:introduced=0,fixed=98.1.210; CefSharp.OffScreen.NetCore (NuGet) ECOSYSTEM:introduced=0,fixed=98.1.210; and 5 more.
Is there a fix for CVE-2022-0609?
Yes. CefSharp.Common (NuGet): upgrade to 98.1.210 or later; CefSharp.Common.NETCore (NuGet): upgrade to 98.1.210 or later; CefSharp.OffScreen (NuGet): upgrade to 98.1.210 or later; CefSharp.OffScreen.NetCore (NuGet): upgrade to 98.1.210 or later; CefSharp.WinForms (NuGet): upgrade to 98.1.210 or later; CefSharp.WinForms.NetCore (NuGet): upgrade to 98.1.210 or later; CefSharp.Wpf (NuGet): upgrade to 98.1.210 or later; CefSharp.Wpf.HwndHost (NuGet): upgrade to 98.1.210 or later; CefSharp.Wpf.NetCore (NuGet): upgrade to 98.1.210 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0609 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2022-0609?
Check whether you run Google Chromium Animation, CefSharp.Common (NuGet), CefSharp.Common.NETCore (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • CefSharp.Common (NuGet): upgrade to 98.1.210 or later
    dotnet add package CefSharp.Common --version 98.1.210
  • CefSharp.Common.NETCore (NuGet): upgrade to 98.1.210 or later
    dotnet add package CefSharp.Common.NETCore --version 98.1.210
  • CefSharp.OffScreen (NuGet): upgrade to 98.1.210 or later
    dotnet add package CefSharp.OffScreen --version 98.1.210
  • CefSharp.OffScreen.NetCore (NuGet): upgrade to 98.1.210 or later
    dotnet add package CefSharp.OffScreen.NetCore --version 98.1.210
  • CefSharp.WinForms (NuGet): upgrade to 98.1.210 or later
    dotnet add package CefSharp.WinForms --version 98.1.210
  • CefSharp.WinForms.NetCore (NuGet): upgrade to 98.1.210 or later
    dotnet add package CefSharp.WinForms.NetCore --version 98.1.210
  • CefSharp.Wpf (NuGet): upgrade to 98.1.210 or later
    dotnet add package CefSharp.Wpf --version 98.1.210
  • CefSharp.Wpf.HwndHost (NuGet): upgrade to 98.1.210 or later
    dotnet add package CefSharp.Wpf.HwndHost --version 98.1.210
  • CefSharp.Wpf.NetCore (NuGet): upgrade to 98.1.210 or later
    dotnet add package CefSharp.Wpf.NetCore --version 98.1.210

Affected products

  • Google Chrome prior to 98.0.4758.102
  • Microsoft Edge
  • Opera Software Opera

Identifiers

  • CVE-2022-0609
  • GHSA-vv6j-ww6x-54gx

Timeline

  • 2022-02-14: patched: Stable channel update for desktop released (98.0.4758.102)
  • 2022-02-15: disclosed: Vulnerability published and added to CISA KEV catalog
  • 2022-02-15: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2022-02-15: exploited: Reported as exploited in the wild at time of publication

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.