Actively exploited · Published Jul 28, 2022 · Assigned by Chrome
CVE-2022-2294
High 8.8 Exploited Ransomware
In plain English
A high-severity out-of-bounds write in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on August 25, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 70.8% (higher than 99.4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Sep 15, 2022.
Official description
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | chromium | 103.0.5060.114-r0 | ALPINE-CVE-2022-2294 |
| Alpine:v3.21 | chromium | 103.0.5060.114-r0 | ALPINE-CVE-2022-2294 |
| Alpine:v3.22 | chromium | 103.0.5060.114-r0 | ALPINE-CVE-2022-2294 |
| Alpine:v3.23 | chromium | 103.0.5060.114-r0 | ALPINE-CVE-2022-2294 |
| Alpine:v3.24 | chromium | 103.0.5060.114-r0 | ALPINE-CVE-2022-2294 |
| Alpine:v3.20 | qt5-qtwebengine | 5.15.3_git20220601-r1 | ALPINE-CVE-2022-2294 |
| Alpine:v3.21 | qt5-qtwebengine | 5.15.3_git20220601-r1 | ALPINE-CVE-2022-2294 |
| Alpine:v3.22 | qt5-qtwebengine | 5.15.3_git20220601-r1 | ALPINE-CVE-2022-2294 |
| Alpine:v3.23 | qt5-qtwebengine | 5.15.3_git20220601-r1 | ALPINE-CVE-2022-2294 |
| Alpine:v3.20 | webkit2gtk | 2.36.5-r0 | ALPINE-CVE-2022-2294 |
| Alpine:v3.20 | webkit2gtk-6.0 | 2.36.5-r0 | ALPINE-CVE-2022-2294 |
| Alpine:v3.21 | webkit2gtk-6.0 | 2.36.5-r0 | ALPINE-CVE-2022-2294 |
| Alpine:v3.22 | webkit2gtk-6.0 | 2.36.5-r0 | ALPINE-CVE-2022-2294 |
| Alpine:v3.23 | webkit2gtk-6.0 | 2.36.5-r0 | ALPINE-CVE-2022-2294 |
| Alpine:v3.24 | webkit2gtk-6.0 | 2.36.5-r0 | ALPINE-CVE-2022-2294 |
| Debian:12 | chromium | 103.0.5060.114-1 | DEBIAN-CVE-2022-2294 |
| Debian:13 | chromium | 103.0.5060.114-1 | DEBIAN-CVE-2022-2294 |
| Debian:14 | chromium | 103.0.5060.114-1 | DEBIAN-CVE-2022-2294 |
| Debian:12 | webkit2gtk | 2.36.6-1 | DEBIAN-CVE-2022-2294 |
| Debian:13 | webkit2gtk | 2.36.6-1 | DEBIAN-CVE-2022-2294 |
| Debian:14 | webkit2gtk | 2.36.6-1 | DEBIAN-CVE-2022-2294 |
| Debian:12 | wpewebkit | 2.36.6-1 | DEBIAN-CVE-2022-2294 |
| Debian:13 | wpewebkit | 2.36.6-1 | DEBIAN-CVE-2022-2294 |
| Debian:14 | wpewebkit | 2.36.6-1 | DEBIAN-CVE-2022-2294 |
| Ubuntu:22.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2022-2294 |
| Ubuntu:24.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2022-2294 |
| Ubuntu:22.04:LTS | webkit2gtk | 2.36.6-0ubuntu0.22.04.1 | UBUNTU-CVE-2022-2294 |
| Ubuntu:22.04:LTS | webkit2gtk | 2.36.6-0ubuntu0.22.04.1 | USN-5568-1 |
| Ubuntu:22.04:LTS | wpewebkit | no fix listed | UBUNTU-CVE-2022-2294 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://crbug.com/1341043
- https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html
- FEDORA-2022-0102ccc2a2 vendor-advisory
- FEDORA-2022-1d3d5a0341 vendor-advisory
- [oss-security] 20220728 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0007 mailing-list
- GLSA-202208-35 vendor-advisory
- GLSA-202208-39 vendor-advisory
- GLSA-202311-11 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-2294 government-resource