Patch gapping is a serious issue that puts a system at risk of exploits. The problem stems from a gap in time before a patch of a security vulnerability in an open-source software is shipped to users.
The vulnerability may have been fixed already, or in the process of being fixed, and attackers can exploit the time before the patch arrives on users’ devices. This window, in which the knowledge of the vulnerability is semi-public while the user-base remains vulnerable, can range from days to months, explains security researcher István Kurucsai.
The Patch Gap in Google Chrome Explained
The researcher just discovered an instance of this issue in Google Chrome. The flaw could have been exploited in attacks against Chrome users days before the patch arrived.
An interesting change list on chromium-review piqued our interest in mid-August. It was for an issue affecting sealed and frozen objects, including a regression test that triggered a segmentation fault. It has been abandoned (and deleted) since then in favor of a different patch approach, with work continuing under CL 1760976, which is a much more involved change, the researcher wrote in a blog post.
Shortly said, the patch gap is due to the V8 issue which was patched in August. “Since the fix turned out to be so complex, the temporary solution for the 7.7 v8 branch was to disable the affected functionality. This will only be rolled into a stable release on the 10th of September,” the researcher explained. In other words, the issue should now be closed with the release of Chrome 77.
It should be noted that the PoC is not efficient enough as a second vulnerability to escape the Chrome sandbox is needed. However, attackers still could have utilized older Chrome sandbox escape flaws to leverage them with the patch gap issue.
Last year, researchers Karsten Nohl and Jakob Lell from security firm Security Research Labs uncovered a hidden patch gap in Android devices. The two conducted a two-year analysis of 1,200 Android phones only to discover that most Android vendors regularly forget to include some patches, leaving parts of the ecosystem exposed to various threats.