The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.

Chromium was updated to latest stable release 42.0.2311.90 to fix security issues and bugs. The following vulnerabilities were fixed :

  - CVE-2015-1235: Cross-origin-bypass in HTML parser.

  - CVE-2015-1236: Cross-origin-bypass in Blink.

  - CVE-2015-1237: Use-after-free in IPC.

  - CVE-2015-1238: Out-of-bounds write in Skia.

  - CVE-2015-1240: Out-of-bounds read in WebGL.

  - CVE-2015-1241: Tap-Jacking.

  - CVE-2015-1242: Type confusion in V8.

  - CVE-2015-1244: HSTS bypass in WebSockets.

  - CVE-2015-1245: Use-after-free in PDFium.

  - CVE-2015-1246: Out-of-bounds read in Blink.

  - CVE-2015-1247: Scheme issues in OpenSearch.

  - CVE-2015-1248: SafeBrowsing bypass.

  - CVE-2015-1249: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2015-3333: Multiple vulnerabilities in V8 fixed at     the tip of the 4.2 branch (currently 4.2.77.14).

  - CVE-2015-3336: fullscreen and UI locking without user     confirmeation

  - CVE-2015-3335: unspecified impact of crafed programs     running in NaCl sandbox 

  - CVE-2015-3334: 'Media: Allowed by you' sometimes not     shown in a permissions table

New functionality added :

  - A number of new apps, extension and Web Platform APIs     (including the Push API!)

  - Lots of under the hood changes for stability and     performance

The version of Google Chrome installed on the remote Mac OS X host is prior to 42.0.2311.90. It is, therefore, affected by multiple vulnerabilities :

  - A cross-origin bypass vulnerability exists due to an     unspecified flaw in the HTML parser. (CVE-2015-1235)

  - A cross-origin bypass vulnerability exists due to a flaw     in MediaElementAudioSourceNode.cpp when handling audio     content. (CVE-2015-1236)

  - A use-after-free error exists in render_frame_impl.cc     due to improper handling of a frame when it receives     messages while detaching. An attacker can exploit this     flaw to dereference already freed memory and execute     arbitrary code. (CVE-2015-1237)

  - An unspecified out-of-bounds write flaw exists in the     Skia filters. (CVE-2015-1238)

  - An out-of-bounds read flaw exists in WebGL due to     improper handling of ES3 commands. An attacker can     exploit this flaw to disclose memory contents.
    (CVE-2015-1240)

  - An unspecified tap-jacking flaw exists when certain tap     events aren't preceded by TapDown events. An attacker     can exploit this to direct taps to cross-pages and     cross-domains. (CVE-2015-1241)

  - A type confusion error exists in the     ReduceTransitionElementsKind() function in     hydrogen-check-elimination.cc. An attacker can exploit     this error to execute arbitrary code. (CVE-2015-1242)

  - A flaw exists related to WebSocket connections due to     HTTP Strict Transport Security (HSTS) not being strictly     enforced. A man-in-the-middle attacker can exploit this     flaw to view and manipulate protected communication.
    (CVE-2015-1244)

  - A use-after-free error exists in     open_pdf_in_reader_view.cc due to improper handling     handling the 'Open PDF in Reader' bubble on navigations.
    An attacker can exploit this flaw to dereference already     freed memory and execute arbitrary code. (CVE-2015-1245)

  - An unspecified out-of-bounds read flaw exists in Blink.
    An attacker can exploit this to disclose memory     contents. (CVE-2015-1246)

  - A flaw exists in the OnPageHasOSDD() function in     search_engine_tab_helper.cc due to improper handling     of URLs for the OpenSearch descriptor. An attacker can     exploit this flaw to disclose sensitive information.
    (CVE-2015-1247)

  - An unspecified flaw exists that allows an attacker to     bypass SafeBrowsing. (CVE-2015-1248)

  - Multiple unspecified vulnerabilities exist that allow an     attacker to have an unspecified impact. (CVE-2015-1249)

  - Multiple unspecified vulnerabilities exist in V8 that     allow an attacker to cause a denial of service and     other unspecified impacts.
    (CVE-2015-3333)

  - A media permission handling weakness exists due to     camera and microphone permissions being merged into a     single 'Media' permission. An attacker can exploit this,     via a specially crafted website, to turn on a victim's     camera while the victim believes camera access is     prohibited. (CVE-2015-3334)

  - A flaw exists due to missing address space usage     limitation (RLIMIT_AS and RLIMIT_DATA) in the Native     Client (NaCl) process. This allows a remote attacker to     run a crafted program in the NaCl sandbox and to conduct     row-hammer attacks. (CVE-2015-3335)     Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 42.0.2311.90. It is, therefore, affected by multiple vulnerabilities :

  - A cross-origin bypass vulnerability exists due to an     unspecified flaw in the HTML parser. (CVE-2015-1235)

  - A cross-origin bypass vulnerability exists due to a flaw     in MediaElementAudioSourceNode.cpp when handling audio     content. (CVE-2015-1236)

  - A use-after-free error exists in render_frame_impl.cc     due to improper handling of a frame when it receives     messages while detaching. An attacker can exploit this     flaw to dereference already freed memory and execute     arbitrary code. (CVE-2015-1237)

  - An unspecified out-of-bounds write flaw exists in the     Skia filters. (CVE-2015-1238)

  - An out-of-bounds read flaw exists in WebGL due to     improper handling of ES3 commands. An attacker can     exploit this flaw to disclose memory contents.
    (CVE-2015-1240)

  - An unspecified tap-jacking flaw exists when certain tap     events aren't preceded by TapDown events. An attacker     can exploit this to direct taps to cross-pages and     cross-domains. (CVE-2015-1241)

  - A type confusion error exists in the     ReduceTransitionElementsKind() function in     hydrogen-check-elimination.cc. An attacker can exploit     this error to execute arbitrary code. (CVE-2015-1242)

  - A flaw exists related to WebSocket connections due to     HTTP Strict Transport Security (HSTS) not being strictly     enforced. A man-in-the-middle attacker can exploit this     flaw to view and manipulate protected communication.
    (CVE-2015-1244)

  - A use-after-free error exists in     open_pdf_in_reader_view.cc due to improper handling     handling the 'Open PDF in Reader' bubble on navigations.
    An attacker can exploit this flaw to dereference already     freed memory and execute arbitrary code. (CVE-2015-1245)

  - An unspecified out-of-bounds read flaw exists in Blink.
    An attacker can exploit this to disclose memory     contents. (CVE-2015-1246)

  - A flaw exists in the OnPageHasOSDD() function in     search_engine_tab_helper.cc due to improper handling     of URLs for the OpenSearch descriptor. An attacker can     exploit this flaw to disclose sensitive information.
    (CVE-2015-1247)

  - An unspecified flaw exists that allows an attacker to     bypass SafeBrowsing. (CVE-2015-1248)

  - Multiple unspecified vulnerabilities exist that allow an     attacker to have an unspecified impact. (CVE-2015-1249)

  - Multiple unspecified vulnerabilities exist in V8 that     allow an attacker to cause a denial of service and     other unspecified impacts.
    (CVE-2015-3333)

  - A media permission handling weakness exists due to     camera and microphone permissions being merged into a     single 'Media' permission. An attacker can exploit this,     via a specially crafted website, to turn on a victim's     camera while the victim believes camera access is     prohibited. (CVE-2015-3334)

  - A flaw exists due to missing address space usage     limitation (RLIMIT_AS and RLIMIT_DATA) in the Native     Client (NaCl) process. This allows a remote attacker to     run a crafted program in the NaCl sandbox and to conduct     row-hammer attacks. (CVE-2015-3335)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
83025	openSUSE Security Update : Chromium (openSUSE-2015-320)	Nessus	SuSE Local Security Checks	high
82826	Google Chrome < 42.0.2311.90 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
82825	Google Chrome < 42.0.2311.90 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2015-3335

high

Tenable Plugins

high

high

high