CVE-2024-4368: Use after free in Dawn

Reference Links

• https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_30.html (Advisory)
• https://issues.chromium.org/issues/333508731
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7I4FMQSOVTCIIH4XT2MJGEQRUACLPB6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN/
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-4368 (Advisory)
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/

Parent vulnerabilities

(Appears in the following advisories)

• 5048180670331116560

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2024-4331

Frequently Asked Questions

• What is the severity of CVE-2024-4368?

  CVE-2024-4368 has been classified as a high-severity vulnerability due to the potential for exploitation via a use after free condition.

• How do I fix CVE-2024-4368?

  To mitigate CVE-2024-4368, users should update Google Chrome to version 124.0.6367.118 or later, or Microsoft Edge (Chromium-based) as per the official release notes.

• Which versions are affected by CVE-2024-4368?

  CVE-2024-4368 affects Google Chrome versions prior to 124.0.6367.118 and specific versions of Microsoft Edge that do not include the latest security patches.

• What types of software are affected by CVE-2024-4368?

  CVE-2024-4368 affects Google Chrome, Microsoft Edge (Chromium-based), and specific versions of Fedora.

• What is a use after free vulnerability in CVE-2024-4368?

  A use after free vulnerability in CVE-2024-4368 occurs when a program continues to use memory after it has been freed, potentially allowing an attacker to execute arbitrary code.