CVE-2020-6384: Use After Free

Q: What is CVE-2020-6384?

CVE-2020-6384 is a vulnerability in WebAudio in Google Chrome prior to version 80.0.3987.116 that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Q: How severe is CVE-2020-6384?

CVE-2020-6384 has a severity rating of 8.8 (High).

Q: How can I fix CVE-2020-6384?

To fix CVE-2020-6384, you should update Google Chrome to version 80.0.3987.116 or later.

Q: Where can I find more information about CVE-2020-6384?

You can find more information about CVE-2020-6384 at the following references: [link1], [link2], [link3].

Q: What is the Common Weakness Enumeration (CWE) ID associated with CVE-2020-6384?

CVE-2020-6384 is associated with CWE-416.

Published Feb 18, 2020

Updated

An use after free flaw was found in the WebAudio component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1048473

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop18.html

Other sources

Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected Software

11 affected componentsFixes available

redhat/chromium-browser<0:80.0.3987.122-1.el6_10

0:80.0.3987.122-1.el6_10

debian/chromium

90.0.4430.212-1~deb10u1116.0.5845.180-1~deb11u1120.0.6099.129-1~deb11u1119.0.6045.199-1~deb12u1120.0.6099.129-1~deb12u1120.0.6099.129-1

redhat/chromium-browser<80.0.3987.116

80.0.3987.116

Google Chrome<80.0.3987.116

Fedoraproject Fedora=30

Fedoraproject Fedora=31

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 0:80.0.3987.122-1.el6_10
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1
Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 80.0.3987.116
Upgrade
Upgrade Chromium / Google Chrome (WebAudio) to a version that resolves this vulnerability.
Fixed in 80.0.3987.116
Compensating control
Mitigate by limiting exposure to untrusted HTML/网页 content until browsers are updated to address the WebAudio use-after-free (Google Chrome prior to 80.0.3987.116).

Event History

Feb 18, 2020

CVE Published

12:00 AM

Feb 27, 2020

CVE Published

via MITRE·10:55 PM

Data Sourced

via MITRE·10:55 PM

DescriptionWeakness

Data Sourced

via NVD·11:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

RHSA-2020:0738

Frequently Asked Questions

What is CVE-2020-6384?

CVE-2020-6384 is a vulnerability in WebAudio in Google Chrome prior to version 80.0.3987.116 that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

How severe is CVE-2020-6384?

CVE-2020-6384 has a severity rating of 8.8 (High).

How can I fix CVE-2020-6384?