CVE-2021-38003: Inappropriate implementation in V8

Q: What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2021-38003.

Q: What is the title of this vulnerability?

The title of this vulnerability is Google Chromium V8 Memory Corruption Vulnerability.

Q: What software is affected by this vulnerability?

Web browsers that utilize Chromium, including Google Chrome and Microsoft Edge, are affected by this vulnerability.

Q: What is the severity of CVE-2021-38003?

CVE-2021-38003 has a severity rating of 8.8 (high).

Q: How does CVE-2021-38003 affect Google Chrome?

Google Chrome versions up to 95.0.4638.69 are affected by CVE-2021-38003.

Q: How does CVE-2021-38003 affect Fedora?

Fedora version 34 is affected by CVE-2021-38003.

Q: How does CVE-2021-38003 affect Debian Linux 10?

Debian Linux version 10.0 is affected by CVE-2021-38003.

Q: How does CVE-2021-38003 affect Debian Linux 11?

Debian Linux version 11.0 is affected by CVE-2021-38003.

Q: How do I fix CVE-2021-38003 on Google Chrome?

To fix CVE-2021-38003 on Google Chrome, update to versions 95.0.4638.69 or newer.

Q: How do I fix CVE-2021-38003 on Fedora?

To fix CVE-2021-38003 on Fedora, apply the necessary updates mentioned in the reference link.

Published Oct 26, 2021

Updated

Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Other sources

Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Credit

Clément Lecigne(Google TAG), Samuel Groß(Google Project Zero)

Affected Software

7 affected componentsFixes available

debian/chromium<=90.0.4430.212-1~deb10u1

116.0.5845.180-1~deb11u1118.0.5993.70-1~deb11u1116.0.5845.180-1~deb12u1118.0.5993.70-1~deb12u1118.0.5993.70-1

Google Chrome<95.0.4638.69

95.0.4638.69

Google Chromium V8

Google Chrome<95.0.4638.69

Fedoraproject Fedora=34

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 116.0.5845.180-1~deb11u1Fixed in 118.0.5993.70-1~deb11u1Fixed in 116.0.5845.180-1~deb12u1Fixed in 118.0.5993.70-1~deb12u1Fixed in 118.0.5993.70-1
Upgrade
Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.
Fixed in 95.0.4638.69

Event History

Oct 26, 2021

CVE Published

12:00 AM

Known Exploited

12:00 AM

Nov 23, 2021

CVE Published

via MITRE·09:30 PM

Data Sourced

via MITRE·09:30 PM

DescriptionWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

8146707100851062467

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2021-38003.

What is the title of this vulnerability?

The title of this vulnerability is Google Chromium V8 Memory Corruption Vulnerability.

What software is affected by this vulnerability?

Web browsers that utilize Chromium, including Google Chrome and Microsoft Edge, are affected by this vulnerability.

What is the severity of CVE-2021-38003?

CVE-2021-38003 has a severity rating of 8.8 (high).

How does CVE-2021-38003 affect Google Chrome?

Google Chrome versions up to 95.0.4638.69 are affected by CVE-2021-38003.

How does CVE-2021-38003 affect Fedora?

Fedora version 34 is affected by CVE-2021-38003.

How does CVE-2021-38003 affect Debian Linux 10?

Debian Linux version 10.0 is affected by CVE-2021-38003.

How does CVE-2021-38003 affect Debian Linux 11?