CVE-2015-3335 in Chrome
Summary
by MITRE
The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/09/2022
The vulnerability described in CVE-2015-3335 resides within the Native Client sandbox implementation in Google Chrome versions prior to 42.0.2311.90. This issue affects the NaClSandbox::InitializeLayerTwoSandbox function located in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc, which is responsible for establishing security boundaries for Native Client processes on Linux systems. The vulnerability stems from the absence of critical resource limit enforcement mechanisms that would normally constrain memory allocation behavior within the sandbox environment. Native Client technology allows web applications to execute native code within the browser, providing performance benefits while maintaining security isolation. However, the missing RLIMIT_AS and RLIMIT_DATA limits create a significant security gap that undermines the sandbox's effectiveness.
The technical flaw manifests as the omission of memory resource limits that would normally restrict the virtual address space and data segment size for processes running within the NaCl sandbox. RLIMIT_AS controls the maximum virtual memory that can be allocated to a process, while RLIMIT_DATA sets the limit on the data segment size. Without these constraints, malicious code within the sandbox can potentially exhaust available memory resources more aggressively than intended. This vulnerability creates opportunities for attackers to exploit memory layout characteristics and memory access patterns that are typically protected by such limits. The specific impact involves enabling row-hammer attacks, where attackers can manipulate memory rows to cause bit flips in adjacent memory locations through repeated memory access patterns.
The operational impact of this vulnerability extends beyond simple memory exhaustion scenarios and represents a significant threat to system security and stability. Row-hammer attacks exploit the physical properties of DRAM memory cells, where repeated access to memory rows can cause electrical interference leading to data corruption. The lack of memory limits in the NaCl sandbox removes barriers that would normally prevent attackers from executing the extensive memory access patterns required for such attacks. Additionally, the vulnerability creates potential for unspecified other impacts that could include privilege escalation, information disclosure, or denial of service conditions. The sandbox's integrity is compromised because the missing limits allow processes to consume more memory resources than intended, potentially enabling attackers to bypass other security mechanisms or create conditions that facilitate more sophisticated attacks.
Mitigation strategies for this vulnerability involve updating to Google Chrome version 42.0.2311.90 or later, which includes the proper implementation of RLIMIT_AS and RLIMIT_DATA limits within the NaCl sandbox initialization process. System administrators should also consider implementing additional monitoring for unusual memory consumption patterns within sandboxed processes and ensure that all browser updates are applied promptly. The vulnerability aligns with CWE-119, which addresses weaknesses in memory safety, and relates to ATT&CK technique T1059.006 for execution through native code. Organizations should also review their overall security posture and consider implementing additional sandboxing measures beyond the default NaCl implementation to reduce the attack surface. This vulnerability demonstrates the importance of comprehensive resource limit enforcement in sandboxed environments and highlights the critical need for proper memory management within trusted execution contexts.