Google Chrome Stack Buffer Overflow Vulnerability in Tracing Component

A stack buffer overflow vulnerability has been identified in the Tracing component of Google Chrome. This issue affects versions prior to 132.0.6834.83. The vulnerability allows remote attackers to potentially exploit stack corruption by using a crafted HTML page. The root cause lies in the 'ProducerSocketConnector::ConnectSocket' function, where an environment variable can be manipulated to overwrite the stack, leading to memory corruption.

Impact

Exploitation of this vulnerability causes a stack buffer overflow, which can lead to memory corruption. In the context of Chrome, this could allow for arbitrary code execution or causing a crash.

Reproduction

The vulnerability can be reproduced by setting the 'PERFETTO_PRODUCER_SOCK_NAME' environment variable to a long, crafted socket name. This can be done by using the 'setenv' function to inject a name that exceeds the buffer size limit. Once the environment variable is set, running the Chrome services unit tests will trigger the buffer overflow. The AddressSanitizer tool will report the stack-buffer-overflow error, indicating that the vulnerability has been successfully exploited.

Remediation

Users should update to Google Chrome version 132.0.6834.83 or later, where this vulnerability has been fixed.