CVE-2024-5159: Google Chrome Buffer Overflow Vulnerability

CVE-2024-5159 Overview

CVE-2024-5159 is a heap buffer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine) in Google Chrome prior to version 125.0.6422.76. This vulnerability allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. The Chromium security team has rated this vulnerability as High severity.

ANGLE is a critical graphics abstraction layer used by Chrome to translate OpenGL ES API calls to various native graphics APIs (DirectX on Windows, OpenGL on other platforms). A heap buffer overflow in this component can have serious security implications, potentially allowing attackers to read sensitive memory contents or chain with other vulnerabilities for more severe attacks.

Critical Impact

Remote attackers can exploit this heap buffer overflow to perform out-of-bounds memory reads, potentially leaking sensitive information or destabilizing the browser through crafted HTML pages.

Affected Products

• Google Chrome versions prior to 125.0.6422.76
• Fedora 39 (prior to patched chromium package)
• Fedora 40 (prior to patched chromium package)

Discovery Timeline

• 2024-05-22 - CVE-2024-5159 published to NVD
• 2024-12-19 - Last updated in NVD database

Technical Details for CVE-2024-5159

Vulnerability Analysis

This vulnerability (classified as CWE-125: Out-of-Bounds Read) exists within the ANGLE graphics layer of Google Chrome. ANGLE serves as a translation layer that converts OpenGL ES 2.0/3.x API calls to platform-specific graphics APIs, making it a foundational component for Chrome's WebGL rendering capabilities.

The heap buffer overflow occurs when processing specially crafted graphics commands, allowing an attacker to read memory beyond the allocated buffer boundaries. This type of vulnerability can expose sensitive data stored in adjacent heap memory regions, potentially including authentication tokens, encryption keys, or other security-critical information.

The attack requires user interaction, specifically that a victim must navigate to a malicious webpage containing the crafted HTML content. Once triggered, the vulnerability executes within the context of the browser's renderer process, which is sandboxed but still poses significant risk for information disclosure.

Root Cause

The root cause is a heap buffer overflow within the ANGLE component, specifically related to improper boundary checking when processing graphics operations. When certain graphics commands are processed, the code fails to properly validate buffer boundaries, allowing memory reads beyond the allocated heap buffer. This represents a classic memory safety issue where input validation and buffer size checks are insufficient.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must:

1. Create a malicious webpage containing specially crafted HTML/JavaScript that triggers the vulnerable code path in ANGLE
2. Lure a victim to visit the malicious page through phishing, malicious advertisements, or compromised legitimate websites
3. The crafted graphics operations cause the heap buffer overflow, resulting in out-of-bounds memory reads
4. Sensitive information from adjacent heap memory may be exfiltrated to the attacker

The vulnerability is exploitable through any Chromium-based browser that has not been updated to version 125.0.6422.76 or later. For detailed technical information, refer to the Chromium Issue Tracker Entry.

Detection Methods for CVE-2024-5159

Indicators of Compromise

• Unexpected browser crashes or instability when visiting untrusted websites
• Abnormal memory consumption patterns in Chrome's GPU process
• Browser sandbox escape attempts detected by endpoint security solutions
• Unusual outbound network traffic following visits to suspicious pages

Detection Strategies

• Monitor for Chrome processes exhibiting anomalous memory access patterns
• Deploy browser version auditing to identify unpatched Chrome installations across the enterprise
• Utilize endpoint detection and response (EDR) solutions capable of detecting heap overflow exploitation attempts
• Implement network security monitoring for known malicious domains serving WebGL-based exploits

Monitoring Recommendations

• Enable Chrome's crash reporting and review crash dumps for ANGLE-related failures
• Monitor security telemetry from SentinelOne agents for browser exploitation attempts
• Track browser update compliance across managed endpoints
• Review web proxy logs for access to suspicious domains hosting graphics-based exploits

How to Mitigate CVE-2024-5159

Immediate Actions Required

• Update Google Chrome to version 125.0.6422.76 or later immediately
• Enable automatic updates for all Chromium-based browsers in your environment
• Deploy enterprise browser management policies to enforce minimum version requirements
• Consider temporarily disabling WebGL on high-risk systems if immediate patching is not possible

Patch Information

Google has addressed this vulnerability in Chrome version 125.0.6422.76 released on May 21, 2024. The fix is detailed in the Google Chrome Stable Update announcement.

For Fedora users, patched packages are available through the standard update channels:

• Fedora 39 Package Announcement
• Fedora 40 Package Announcement

Organizations using Chromium-based browsers should verify their version is at or above 125.0.6422.76.

Workarounds

• Disable WebGL in Chrome by navigating to chrome://flags/#disable-webgl and enabling the flag (temporary mitigation only)
• Use browser isolation solutions for high-risk web browsing activities
• Implement strict Content Security Policy headers on internal web applications to prevent loading of untrusted graphics content
• Consider network-level blocking of known malicious domains that may be serving exploit code

# Verify Chrome version from command line
google-chrome --version

# For enterprise deployment, use Chrome Browser Cloud Management
# to enforce minimum version requirements across managed devices

# Linux: Update Chrome via package manager
sudo apt update && sudo apt upgrade google-chrome-stable

# Fedora: Update chromium package
sudo dnf update chromium