CVE-2024-5845: Google Chrome Use After Free Vulnerability

CVE-2024-5845 Overview

CVE-2024-5845 is a use-after-free vulnerability in the Audio component of Google Chrome prior to version 126.0.6478.54. This memory corruption flaw allows a remote attacker to potentially exploit heap corruption through a specially crafted PDF file. The vulnerability was classified with medium severity by the Chromium security team and presents a significant risk as it can be triggered remotely through malicious content.

Critical Impact
Remote attackers can exploit this use-after-free vulnerability to potentially achieve arbitrary code execution or cause browser crashes through heap corruption when processing malicious PDF files.

Affected Products

Google Chrome versions prior to 126.0.6478.54
Fedora 39 (through bundled Chromium packages)
Fedora 40 (through bundled Chromium packages)

Discovery Timeline

2024-06-11 - CVE-2024-5845 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-5845

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption condition where a program continues to reference memory after it has been freed. In the context of Google Chrome's Audio component, the vulnerability manifests during the processing of audio elements embedded within PDF files.

Use-after-free vulnerabilities are particularly dangerous in browser environments because they can potentially lead to arbitrary code execution. When memory is freed but subsequently referenced, attackers can potentially manipulate the heap to control the contents of the freed memory region. This allows them to redirect program execution or corrupt critical data structures.

The attack requires user interaction—specifically, the victim must open a malicious PDF file within the browser. The network-based attack vector means the exploit can be delivered through various means including phishing emails, compromised websites, or malicious advertisements.

Root Cause

The root cause is improper memory management in Google Chrome's Audio subsystem when handling audio resources within PDF documents. The code fails to properly track the lifecycle of audio-related objects, leading to a scenario where a reference to a freed memory region is accessed. This creates an exploitable condition where the freed memory can be reallocated with attacker-controlled content before the dangling reference is used.

Attack Vector

The attack leverages the network as the primary vector, requiring the victim to open a specially crafted PDF file in an affected Chrome browser. The exploitation flow typically involves:

An attacker creates a malicious PDF file containing specially crafted audio elements
The victim opens the PDF file in Google Chrome (versions prior to 126.0.6478.54)
The PDF triggers the use-after-free condition in the Audio component
Heap corruption occurs, potentially allowing code execution or browser crash

The vulnerability can be weaponized through social engineering techniques such as phishing campaigns or drive-by downloads from compromised websites. For technical details regarding the specific implementation, refer to the Chromium Issue #340178596.

Detection Methods for CVE-2024-5845

Indicators of Compromise

Unexpected browser crashes when opening PDF files, particularly those with embedded audio
Chrome crash reports indicating memory corruption in Audio-related components
Suspicious PDF files with unusually complex or malformed audio stream objects
Network traffic to untrusted sources followed by PDF rendering activity

Detection Strategies

Monitor for Chrome crash dumps referencing audio component memory errors
Implement file scanning for PDF documents with suspicious audio object structures
Deploy endpoint detection rules for unexpected memory allocation patterns in browser processes
Track browser version inventories to identify unpatched Chrome installations

Monitoring Recommendations

Enable Chrome Enhanced Safe Browsing to detect known malicious files
Monitor endpoint logs for repeated browser crashes associated with PDF rendering
Implement network-level inspection of downloaded PDF files for known exploit patterns
Use SentinelOne's behavioral AI to detect heap spray and memory corruption exploitation attempts

How to Mitigate CVE-2024-5845

Immediate Actions Required

Update Google Chrome to version 126.0.6478.54 or later immediately
Enable automatic updates in Chrome to ensure timely patch deployment
For Fedora 39/40 users, apply the latest Chromium package updates via dnf update chromium
Educate users about the risks of opening PDF files from untrusted sources

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 126.0.6478.54. The fix was announced in the Google Chrome Stable Update for desktop platforms. Fedora Linux users should apply the updated packages announced in the Fedora Package Announce mailing list.

Workarounds

Disable automatic PDF viewing in Chrome by configuring PDF files to download rather than open inline
Use an alternative PDF reader for documents from untrusted sources
Implement network-level filtering to block or quarantine PDF files from unknown origins
Consider using Chrome's Site Isolation feature to limit the impact of potential exploitation

bash

# Verify Chrome version to ensure patch is applied
google-chrome --version
# Expected output: Google Chrome 126.0.6478.54 or higher

# For Fedora users, update Chromium package
sudo dnf update chromium

# Check installed Chromium version on Fedora
rpm -q chromium