CVE-2024-0518: Google Chrome V8 Type Confusion RCE Flaw

CVE-2024-0518 Overview

CVE-2024-0518 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. This vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. V8 is Chrome's high-performance JavaScript and WebAssembly engine, and type confusion vulnerabilities in this component can lead to serious security consequences including arbitrary code execution.

Critical Impact

Remote attackers can exploit heap corruption through specially crafted web pages, potentially achieving arbitrary code execution in the context of the browser process.

Affected Products

• Google Chrome prior to version 120.0.6099.224
• Fedora Project Fedora 38
• Fedora Project Fedora 39

Discovery Timeline

• January 16, 2024 - CVE-2024-0518 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-0518

Vulnerability Analysis

This vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type - Type Confusion). Type confusion vulnerabilities occur when a program allocates or initializes a resource with one type but later accesses that resource using a type that is incompatible with the original type. In the context of the V8 JavaScript engine, this can lead to memory corruption when the engine incorrectly handles object types during JavaScript execution.

The V8 engine employs Just-In-Time (JIT) compilation to optimize JavaScript execution. Type confusion bugs typically emerge when the JIT compiler makes incorrect assumptions about object types, leading to situations where memory is accessed or manipulated based on incorrect type information. This can result in out-of-bounds memory access, heap corruption, and potentially arbitrary code execution.

Root Cause

The root cause lies in improper type handling within the V8 JavaScript engine's optimization pipeline. When the V8 compiler generates optimized machine code, it may make assumptions about object types that can be violated at runtime. If these assumptions are incorrect, the generated code may access object properties at wrong memory offsets, treating memory regions as different types than they actually contain.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker can exploit this vulnerability by:

1. Creating a malicious HTML page containing specially crafted JavaScript code designed to trigger the type confusion condition
2. Luring a victim to visit the malicious page (via phishing, malvertising, or compromised websites)
3. When the victim's browser processes the JavaScript, the type confusion is triggered
4. The resulting heap corruption can be leveraged to achieve arbitrary code execution within the browser's sandbox

The exploitation occurs entirely within the browser context when processing untrusted web content. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the browser process, though Chrome's sandbox architecture provides an additional layer of defense.

Detection Methods for CVE-2024-0518

Indicators of Compromise

• Unusual Chrome browser crashes, particularly those occurring during JavaScript-heavy page loads
• Crash reports indicating V8-related memory corruption or type errors
• Detection of known exploit patterns in network traffic targeting Chrome users
• Unexpected child processes spawned by the Chrome browser process

Detection Strategies

• Monitor browser crash telemetry for patterns consistent with V8 type confusion exploitation
• Implement network-based detection rules to identify malicious JavaScript payloads targeting this vulnerability
• Deploy endpoint detection solutions capable of identifying heap corruption exploitation attempts
• Review proxy logs for connections to known malicious domains serving exploit code

Monitoring Recommendations

• Enable Chrome's built-in crash reporting to identify potential exploitation attempts
• Configure endpoint detection and response (EDR) solutions to monitor for suspicious browser behavior
• Implement web content filtering to block access to known malicious sites
• Monitor for anomalous memory allocation patterns in browser processes

How to Mitigate CVE-2024-0518

Immediate Actions Required

• Update Google Chrome to version 120.0.6099.224 or later immediately
• Enable automatic updates in Chrome to ensure timely security patches
• For Fedora users, apply the latest security updates via the package manager
• Consider temporarily using alternative browsers if immediate patching is not possible

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 120.0.6099.224. The fix was announced in the Google Chrome Stable Channel Update on January 16, 2024. Technical details can be found in Chromium Bug Report #1507412.

Fedora Project has released security advisories for both Fedora 38 and Fedora 39. Users should update their systems using the standard package management tools to receive the patched version of Chromium.

Workarounds

• Disable JavaScript execution in Chrome (Settings → Privacy and Security → Site Settings → JavaScript) as a temporary measure, though this will significantly impact web browsing functionality
• Use browser isolation technologies to contain potential exploitation attempts
• Implement network-level content filtering to block known malicious payloads
• Consider deploying enterprise browser policies to restrict access to untrusted websites

# Update Chrome on Fedora systems
sudo dnf update chromium --refresh

# Verify Chrome version on Linux
google-chrome --version

# Enable automatic updates in Chrome via policy (enterprise)
# Create or edit /etc/opt/chrome/policies/managed/update_policy.json
echo '{"AutoUpdateCheckPeriodMinutes": 60}' | sudo tee /etc/opt/chrome/policies/managed/update_policy.json