Incomplete disclosures by Apple and Google create “huge blindspot” for 0-day hunters

The researchers wrote: While the vulnerability initially seems to target Chromium-based applications, now that we know better, we understand that it possesses the potential to affect a much wider range of software and applications relying on the ubiquitous libwebp package for WebP codec functionality. This package stands out for its efficiency, outperforming JPEG and PNG in terms of size and speed. Consequently, a multitude of software, applications, and packages have adopted this library, or even adopted packages that libwebp is their dependency, creating a complex challenge when attempting to identify vulnerable systems. The sheer prevalence of libwebp extends the attack surface significantly, raising serious concerns for both users and organizations.

Organizations with SBOM solutions in their environment are advised to query the SBOM for any package using a vulnerable version of libwebp as a dependency. It is especially important to make sure that the system libwebp library is patched as several applications such as chromium for example, are built against the system libwebp library.

Apple

Apple said the vulnerability, tracked as CVE-2023-41064, stemmed from a buffer overflow bug in ImageIO, a proprietary framework that allows applications to read and write most image file formats, which include one known as WebP. Apple credited the discovery of the zero-day to Citizen Lab, a research group at the University of Toronto’s Munk School that follows attacks by nation-states targeting dissidents and other at-risk groups.

Google

Four days later, Google reported a critical vulnerability in its Chrome browser. The company said the vulnerability was what’s known as a heap buffer overflow that was present in WebP. Google went on to warn that an exploit for the vulnerability existed in the wild. Google said that the vulnerability, designated as CVE-2023-4863, was reported by the Apple Security Engineering and Architecture team and Citizen Lab.

Similarities strongly suggested that the underlying bug

Speculation, including from me, quickly arose that a large number of similarities strongly suggested that the underlying bug for both vulnerabilities was the same. On Thursday, researchers from security firm Rezillion published evidence that they said made it “highly likely” both indeed stemmed from the same bug, specifically in libwebp, the code library that apps, operating systems, and other code libraries incorporate to process WebP images.

Rather than Apple, Google, and Citizen Lab coordinating and accurately reporting the common origin of the vulnerability, they chose to use a separate CVE designation, the researchers said. The researchers concluded that “millions of different applications” would remain vulnerable until they, too, incorporated the libwebp fix. That, in turn, they said, was preventing automated systems developers use to track known vulnerabilities in their offerings from detecting a critical vulnerability that’s under active exploitation.

“Since the vulnerability is scoped under the overarching product containing the vulnerable dependency, the vulnerability will only be flagged by vulnerability scanners for these specific products,” Rezillion researchers Ofri Ouzan and Yotam Perkal wrote. “This creates a HUGE blindspot for organizations blindly relying on the output of their vulnerability scanner.”

The number of apps, frameworks, code libraries, and other packages that incorporate libwebp and have yet to receive a patch is unknown. While Microsoft patched CVE-2023-4863 in its Edge browser, the company confirmed in an email on Thursday that other vulnerable products and code packages had yet to be patched. An update for the affected offerings “are in our release pipeline,” the representative said, without providing an estimated release. Microsoft offerings known to remain vulnerable are Teams, a widely used collaboration platform, and the developer tool Visual Studio Code.

The number of affected software packages is too large to check all of them. People who want to know about a specific offering not listed should check with the developer.