Vulnerability-Lookup

GHSA-MHJG-QMR3-W2XC

Vulnerability from github – Published: 2025-04-17 00:30 – Updated: 2025-04-17 15:32

Details

ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 124.0.6367.34 on Chromebooks allows enrolled users with local access to unenroll devices and intercept device management requests via loading components from the unencrypted stateful partition.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-1704"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-16T23:15:44Z",
    "severity": "CRITICAL"
  },
  "details": "ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 124.0.6367.34 on Chromebooks allows enrolled users with local access to unenroll devices \nand intercept device management requests via loading components from the unencrypted stateful partition.",
  "id": "GHSA-mhjg-qmr3-w2xc",
  "modified": "2025-04-17T15:32:35Z",
  "published": "2025-04-17T00:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1704"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/b/359915523"
    },
    {
      "type": "WEB",
      "url": "https://issuetracker.google.com/issues/359915523"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-1704 (GCVE-0-2025-1704)

Vulnerability from cvelistv5 – Published: 2025-04-16 23:06 – Updated: 2025-05-08 19:15

Summary

ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices and intercept device management requests via loading components from the unencrypted stateful partition.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

Use-After-Free (UAF)

Assigner

ChromeOS

References

URL

Tags

	https://issuetracker.google.com/issues/359915523
	https://issues.chromium.org/issues/b/359915523

Impacted products

	Vendor	Product	Version
	Google	ChromeOS	Affected: 15823.23.0 , < 15823.23.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-1704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-17T15:48:23.843965Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T19:45:03.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ChromeOS",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "15823.23.0",
              "status": "affected",
              "version": "15823.23.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices \nand intercept device management requests via loading components from the unencrypted stateful partition."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-After-Free (UAF)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-08T19:15:06.471Z",
        "orgId": "7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f",
        "shortName": "ChromeOS"
      },
      "references": [
        {
          "url": "https://issuetracker.google.com/issues/359915523"
        },
        {
          "url": "https://issues.chromium.org/issues/b/359915523"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f",
    "assignerShortName": "ChromeOS",
    "cveId": "CVE-2025-1704",
    "datePublished": "2025-04-16T23:06:28.279Z",
    "dateReserved": "2025-02-25T23:19:38.958Z",
    "dateUpdated": "2025-05-08T19:15:06.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-MHJG-QMR3-W2XC

CVE-2025-1704 (GCVE-0-2025-1704)

Tags

Sightings

Nomenclature