CVE-2022-2294 is a high-severity heap buffer overflow vulnerability affecting WebRTC in Google Chrome versions prior to 103.0.5060.114. This vulnerability allows a remote attacker to potentially exploit heap corruption through a crafted HTML page. Various software configurations and systems are impacted, including Google Chrome, Fedora Project Extra Packages for Enterprise Linux, Fedora, WebKitGTK, WPE WebKit, Apple iPadOS, Apple iPhone OS, Apple macOS, Apple tvOS, Apple watchOS, and WebRTC Project WebRTC.

How do I know if I'm affected?

If you're using Google Chrome, you may be affected by the vulnerability if your browser version is older than 103.0.5060.114. For WebKitGTK and WPE WebKit users, versions before 2.36.5 with USE_LIBWEBRTC enabled are vulnerable. Fedora 35 users should update Chromium to version 103.0.5060.114-1.fc35. To check if you're affected, simply verify your browser or software version and compare it to the mentioned vulnerable versions.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your software to the latest version. For Google Chrome, wait for the update to roll out and install it. Fedora 35 users should run "su -c 'dnf upgrade --advisory FEDORA-2022-0102ccc2a2'" to update Chromium. For WebKitGTK and WPE WebKit, update to version 2.36.5 or later. Always keep your software up-to-date to stay protected.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-2294 vulnerability, also known as "WebRTC Heap Buffer Overflow Vulnerability," is listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on August 25, 2022, and the due date for addressing the vulnerability is September 15, 2022.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787, which is an out-of-bounds write issue that can lead to remote code execution. Updating affected software helps mitigate this weakness.

For more details

CVE-2022-2294 is a significant vulnerability affecting various software configurations and systems. By updating your software to the latest version, you can mitigate the risk of remote code execution. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• WebKitGTK and WPE WebKit Security Advisory WSA-2022-0007

• Chrome Releases: Stable Channel Update for Desktop

• Fedora 35 Update: chromium-103.0.5060.114-1.fc35

• Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities (GLSA 202208-35)