CVE-2024-1670: Use after free in Mojo

Reference Links

• https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html (Advisory)
• https://issues.chromium.org/issues/41481374
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-1670 (Advisory)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/

Parent vulnerabilities

(Appears in the following advisories)

• 1133025810642778744

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2024-1669
• CVE-2024-5500
• CVE-2024-3168
• CVE-2024-1671
• CVE-2024-1672
• CVE-2024-1673
• CVE-2024-1674
• CVE-2024-1675
• CVE-2024-3171
• CVE-2024-1676

Frequently Asked Questions

• What is the severity of CVE-2024-1670?

  CVE-2024-1670 is classified as a medium severity vulnerability due to a use after free issue in the Chromium codebase.

• How do I fix CVE-2024-1670?

  To fix CVE-2024-1670, users should update Google Chrome to version 122.0.6261.57 or later.

• Which software is affected by CVE-2024-1670?

  CVE-2024-1670 affects Google Chrome versions prior to 122.0.6261.57, Microsoft Edge (Chromium-based), and Fedora 38 and 39.

• What does the use after free vulnerability in CVE-2024-1670 mean?

  The use after free vulnerability in CVE-2024-1670 allows an attacker to potentially execute arbitrary code by accessing memory that has been freed.

• Have there been any exploits reported for CVE-2024-1670?

  As of now, there have been no reported exploits specifically targeting CVE-2024-1670 in the wild.