Use-after-free in WebKitGTK+ and WPE WebKit - CVE-2022-30294

Vulnerability identifier: #VU63823

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-30294

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content within the WebCore::TextureMapperLayer::setContentsLayer() function in WebCore/platform/graphics/texmap/TextureMapperLayer.cpp. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

WebKitGTK+
WPE WebKit
Gentoo Linux
Ubuntu
openEuler
wpewebkit (Debian package)
webkit2gtk (Debian package)
webkit2gtk3-help
webkit2gtk3-debugsource
webkit2gtk3-debuginfo
webkit2gtk3-jsc
webkit2gtk3-devel
webkit2gtk3
webkit2gtk3-jsc-devel
libjavascriptcoregtk-4.0-18 (Ubuntu package)
libwebkit2gtk-4.0-37 (Ubuntu package)
net-libs/webkit-gtk
webkitgtk4 (Red Hat package)
libjavascriptcoregtk-4.1-0 (Ubuntu package)
libwebkit2gtk-4.1-0 (Ubuntu package)

Install updates from vendor's website.

WebKitGTK+ - update to 2.36.1
WPE WebKit - update to 2.36.1
wpewebkit (Debian package) - update to 2.36.3-1~deb11u1
webkit2gtk (Debian package) - addressed in versions 2.36.3-1~deb10u1, 2.36.3-1~deb11u1
webkit2gtk3-help - update to 2.32.1-3
webkit2gtk3-debugsource - update to 2.32.1-3
webkit2gtk3-debuginfo - update to 2.32.1-3
webkit2gtk3-jsc - update to 2.32.1-3
webkit2gtk3-devel - update to 2.32.1-3
webkit2gtk3 - update to 2.32.1-3
webkit2gtk3-jsc-devel - update to 2.32.1-3
libjavascriptcoregtk-4.0-18 (Ubuntu package) - addressed in versions 2.36.2-0ubuntu0.20.04.1, 2.36.2-0ubuntu0.21.10.1, 2.36.2-0ubuntu0.22.04.1
libwebkit2gtk-4.0-37 (Ubuntu package) - addressed in versions 2.36.2-0ubuntu0.20.04.1, 2.36.2-0ubuntu0.21.10.1, 2.36.2-0ubuntu0.22.04.1
libjavascriptcoregtk-4.1-0 (Ubuntu package) - update to 2.36.2-0ubuntu0.22.04.1
libwebkit2gtk-4.1-0 (Ubuntu package) - update to 2.36.2-0ubuntu0.22.04.1
net-libs/webkit-gtk - update to 2.36.7
webkitgtk4 (Red Hat package) - update to 2.48.3-2.el7_9

• https://bugs.webkit.org/show_bug.cgi?id=237188
• https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.36.0
• https://webkitgtk.org/security/WSA-2022-0005.html

• Multiple vulnerabilities in WebKitGTK and WPE WebKit
• Ubuntu update for webkit2gtk
• Debian update for webkit2gtk
• Debian update for wpewebkit
• Gentoo update for WebKitGTK+
• openEuler 22.03 LTS update for webkit2gtk3
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for webkitgtk4