Google Discloses Windows Zero-Day Exploited in the Wild

Security researchers from Google have disclosed today a zero-day vulnerability in the Windows operating system that is currently under active exploitation. From a report: The zero-day is expected to be patched on November 10, which is the date of Microsoft's next Patch Tuesday, according to Ben Hawkes, team lead for Project Zero, Google's elite vulnerability research team. On Twitter, Hawkes said the Windows zero-day (tracked as CVE-2020-17087) was used as part of a two-punch attack, together with another a Chrome zero-day (tracked as CVE-2020-15999) that his team disclosed last week. The Chrome zero-day was used to allow attackers to run malicious code inside Chrome, while the Windows zero-day was the second part of this attack, allowing threat actors to escape Chrome's secure container and run code on the underlying operating system -- in what security experts call a sandbox escape.

You had one job

[Presence Eternal]

I'm not a security expertologist, but I am pretty sure if something can escape your sandbox without some kind of hardware exploit, you did not actually make a sandbox.

Re:

[BeerFartMoron]

Sort of like this one [wfcdn.com]?

It's a Windows kernel driver bug

[Myria]

I'm not a security expertologist, but I am pretty sure if something can escape your sandbox without some kind of hardware exploit, you did not actually make a sandbox.

The bug is that the cng.sys Windows kernel driver doesn't validate its inputs from user mode correctly. cng.sys is the Windows driver that implements the equivalent of UNIX /dev/urandom.

One major point of a sandbox is to limit the surface area that is attackable by a sandboxed program. Unfortunately, cryptographically secure random numbers are one feature that you want a sandbox to have access to, so even sandboxed programs can access cng.sys. This is similar to how /dev/urandom is still created in many chroot jails on UNIX. Imagine a bug in a /dev/urandom IOCTL; that's what this is.

Re:

[swillden]

I read the articles rather quickly and did not see that. All I noticed was something about about font rendering.

Wrong bug; that's the Chrome bug. Exploiting it gets you a chance to exploit the Windows kernel bug, which then lets you break out of the sandbox: https://bugs.chromium.org/p/pr... [chromium.org]

Re:

[arglebargle_xiv]

Well that's just not on, is it! CNG is part of Windows' security, and bad guys aren't supposed to use Windows security components to break Windows security. There's a big "security line, do no cross" label attached to it, and all attackers should respect that and not attack beyond that point. It's just unsporting, I say.

Not Windows, Chrome remote exploit!

[nazsco]

Do not sugar coat it! The windows exploit is local and because you are running Google Chrome(tm) in trusted mode (because of auto-update?)

The real problem here is Google Chrome running trusted code (windows equivalent as root) and a remote exploitable bug.

Re:

[nazsco]

in other words: "It macromedia Flash all over again"!

Re:

[tlhIngan]

It's 'funny' that Windows and iOS haven't managed to figure out reliable and secure third-party distribution when linuxes have had it for nearly two decades.

Not so easy, actually. Microsoft and macOS updates are signed by Microsoft and Apple, respectively, and verified by the associated update daemon for each.

If applications were to use them, then Microsoft and Apple would have to figure out a way to pass on signed updates - Apple can do this via the App Store method where they approve the apps and then cro

Maybe you could clarify

[raymorris]

> because you are running Google Chrome(tm) in trusted mode

> The real problem here is Google Chrome running trusted code (windows equivalent as root)

Maybe you could be a bit more clear what you mean by "trusted code".
I'd say the Windows equivalent of root is System (for root on older *nix) or Administrator (for root on modern *nix).

What, exactly, do you think is different about the context in which Chrome runs can calculator or notepad or anything else?

Re:

[raymorris]

It occurs to me you may be thinking of .NET domains.
If Chrome were a .NET application, you could put a sandbox around the sandbox. Is that what you have in mind?

For the sake of accuracy...

[martynhare]

No, you're not running Google Chrome in "trusted mode" (or with any special privilege). It actually runs most processes in an Untrusted or Low Integrity level, as one can see from a simple Process Explorer check (https://imgur.com/a/xJSf9AQ). The most privileged process Chrome runs is at Medium integrity, which is ordinary user privileges. Chrome uses multiple layers of sandboxing, including system call restrictions and Windows' ability to allow running processes to revoke access to resources by removing

I guess someone has to ask

[bobstreo]

Is Edge impacted?

Seems like the sandbox is overfilled with cat excrement.

one browser

[awwshit]

This problem will only get worse as Chrome/Chromium gain even more market share. IE6 all over again.

Re:

[chispito]

This problem will only get worse as Chrome/Chromium gain even more market share. IE6 all over again.

One rendering engine. Chromium Edge is affected as well.

Threat actors ?

[edi_guy]

Have we become so PC that we cannot just say 'criminals' ? Or must everything be elevated to some version of a Tom Clancy worldview.

Re:

[Kaenneth]

It's not a crime if you're the government...

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re: The question is..

[AcidFnTonic]

Lessor privileges. That's why it doesn't prompt. Uses your users perms.

Re:

[viperidaenz]

Or because Chrome installs its updates into your local user area and Firefox installs itself system wide, so needs the higher permissions to update.

The update process is also not the same as the browser process. Chrome has been doing process isolation since the beginning.

Sure glad I don't run

[oldgraybeard]

or use any Microsoft products anymore.

Good job...

[Skiron]

... I still use my Spectrum ZX. Bloody printer is crap though.

So...Firefox is unaffected?

[bustinbrains]

Great. I'll just keep using Firefox for now.

Uinstall Chrome?

[Cmdln Daco]

So for protection from this the thing to ddo is uninstall Chrime?

Re:

[skids]

No just to upgrade Chrome.

There are two bugs. Any application using FreeType libraries is potentially vulnerable to the first one.

It's unclear how many applications are vulnerable to the second one. Just about anything that needs access to that flavor of random number generator and can be tricked into sending it garbage, I guess. That won't be fixable until the 10th apparently.