CVE-2024-5845: Google Chrome Use After Free Vulnerability

CVE-2024-5845 Overview

CVE-2024-5845 is a use-after-free vulnerability in the Audio component of Google Chrome prior to version 126.0.6478.54. This memory corruption flaw allows a remote attacker to potentially exploit heap corruption through a specially crafted PDF file. The vulnerability was classified with medium severity by the Chromium security team and presents a significant risk as it can be triggered remotely through malicious content.

Critical Impact

Remote attackers can exploit this use-after-free vulnerability to potentially achieve arbitrary code execution or cause browser crashes through heap corruption when processing malicious PDF files.

Affected Products

• Google Chrome versions prior to 126.0.6478.54
• Fedora 39 (through bundled Chromium packages)
• Fedora 40 (through bundled Chromium packages)

Discovery Timeline

• 2024-06-11 - CVE-2024-5845 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-5845

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption condition where a program continues to reference memory after it has been freed. In the context of Google Chrome's Audio component, the vulnerability manifests during the processing of audio elements embedded within PDF files.

Use-after-free vulnerabilities are particularly dangerous in browser environments because they can potentially lead to arbitrary code execution. When memory is freed but subsequently referenced, attackers can potentially manipulate the heap to control the contents of the freed memory region. This allows them to redirect program execution or corrupt critical data structures.

The attack requires user interaction—specifically, the victim must open a malicious PDF file within the browser. The network-based attack vector means the exploit can be delivered through various means including phishing emails, compromised websites, or malicious advertisements.

Root Cause

The root cause is improper memory management in Google Chrome's Audio subsystem when handling audio resources within PDF documents. The code fails to properly track the lifecycle of audio-related objects, leading to a scenario where a reference to a freed memory region is accessed. This creates an exploitable condition where the freed memory can be reallocated with attacker-controlled content before the dangling reference is used.

Attack Vector

The attack leverages the network as the primary vector, requiring the victim to open a specially crafted PDF file in an affected Chrome browser. The exploitation flow typically involves:

1. An attacker creates a malicious PDF file containing specially crafted audio elements
2. The victim opens the PDF file in Google Chrome (versions prior to 126.0.6478.54)
3. The PDF triggers the use-after-free condition in the Audio component
4. Heap corruption occurs, potentially allowing code execution or browser crash

The vulnerability can be weaponized through social engineering techniques such as phishing campaigns or drive-by downloads from compromised websites. For technical details regarding the specific implementation, refer to the Chromium Issue #340178596.

Detection Methods for CVE-2024-5845

Indicators of Compromise

• Unexpected browser crashes when opening PDF files, particularly those with embedded audio
• Chrome crash reports indicating memory corruption in Audio-related components
• Suspicious PDF files with unusually complex or malformed audio stream objects
• Network traffic to untrusted sources followed by PDF rendering activity

Detection Strategies

• Monitor for Chrome crash dumps referencing audio component memory errors
• Implement file scanning for PDF documents with suspicious audio object structures
• Deploy endpoint detection rules for unexpected memory allocation patterns in browser processes
• Track browser version inventories to identify unpatched Chrome installations

Monitoring Recommendations

• Enable Chrome Enhanced Safe Browsing to detect known malicious files
• Monitor endpoint logs for repeated browser crashes associated with PDF rendering
• Implement network-level inspection of downloaded PDF files for known exploit patterns
• Use SentinelOne's behavioral AI to detect heap spray and memory corruption exploitation attempts

How to Mitigate CVE-2024-5845

Immediate Actions Required

• Update Google Chrome to version 126.0.6478.54 or later immediately
• Enable automatic updates in Chrome to ensure timely patch deployment
• For Fedora 39/40 users, apply the latest Chromium package updates via dnf update chromium
• Educate users about the risks of opening PDF files from untrusted sources

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 126.0.6478.54. The fix was announced in the Google Chrome Stable Update for desktop platforms. Fedora Linux users should apply the updated packages announced in the Fedora Package Announce mailing list.

Workarounds

• Disable automatic PDF viewing in Chrome by configuring PDF files to download rather than open inline
• Use an alternative PDF reader for documents from untrusted sources
• Implement network-level filtering to block or quarantine PDF files from unknown origins
• Consider using Chrome's Site Isolation feature to limit the impact of potential exploitation

# Verify Chrome version to ensure patch is applied
google-chrome --version
# Expected output: Google Chrome 126.0.6478.54 or higher

# For Fedora users, update Chromium package
sudo dnf update chromium

# Check installed Chromium version on Fedora
rpm -q chromium