Forest Global Training Partners

Cyber Risks · Google Project Zero

Exploiting Android Messengers with WebRTC: Part 1

Summary: Project Zero's Natalie Silvanovich detailed two WebRTC RTP extension bugs, CVE-2020-6389 and CVE-2020-6387, both introduced in extensions implemented in WebRTC in 2019, and tested whether they were exploitable in popular Android messaging applications. CVE-2020-6389 allows an out-of-bounds write of up to three 64-bit integers past a fixed 80-byte heap buffer via a three-bit layer field that can reach seven against five supported layers, while CVE-2020-6387 writes up to six zero bytes at an offset of up to seven bytes from a variable-sized heap buffer because video timing extensions are not length-checked before being cleared.

Key Takeaway: Silvanovich got a virtual call on an attacker-chosen pointer roughly one in five attempts by sending STUN messages with 128 attributes to land in an infrequently used 1024-byte jemalloc size class, and found instruction-pointer control about one in 20 crashes - meaning messenger apps that ship WebRTC without its patches carry memory-corruption exposure reachable over the network.

Read the original at Google Project Zero ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2020-6387CVE-2020-6389
Related