CVE-2023-5217: Electron Electron Affected By Libvpx's Heap Vulnerability

HIGH
Advisory Identifier: GHSA-qqvq-6xgj-jw8g
Share
CVSS 8.8
CWE-787
Published
Advisory Summary

CVE-2023-5217 is a HIGH (CVSS 8.8) electron affected by libvpx's heap vulnerability (CWE-787: Out-of-bounds Write) affecting Electron libraries in the npm ecosystem. The issue involves electron affected by libvpx's heap buffer overflow in vp8 encoding. Remediation is available by upgrading affected packages to version 22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8.

CVE-2023-5217 at a Glance

CVE Identifier CVE-2023-5217
GHSA Identifier GHSA-qqvq-6xgj-jw8g
Severity HIGH
CVSS v3.1 Base Score 8.8
CWE Classification CWE-787: Out-of-bounds Write
Affected Product Electron
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 8.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2023-5217

To remediate this vulnerability, upgrade all affected Electron dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

electron fixed: 22.3.25 
npm install electron@22.3.25
electron fixed: 24.8.5 
npm install electron@24.8.5
electron fixed: 25.8.4 
npm install electron@25.8.4
electron fixed: 26.2.4 
npm install electron@26.2.4
electron fixed: 27.0.0-beta.8 
npm install electron@27.0.0-beta.8
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls electron

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2023-5217, inspect your project dependencies using npm:

npm ls electron

Analyze the terminal output to locate any version of Electron in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 22.3.25), your application is affected.

Note: The npm ls electron command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-787: Out-of-bounds Write, where the product writes data past the end, or before the beginning, of the intended buffer. In Electron, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2023-5217 Affected Electron Versions

5 component(s)
Fixed Versions:
22.3.2524.8.525.8.426.2.427.0.0-beta.8
Product / Package Ecosystem Affected Versions Fixed Version
electron
npm/electron
npm
< 22.3.25
22.3.25
electron
npm/electron
npm
≥ 24.0.0
< 24.8.5
24.8.5
electron
npm/electron
npm
≥ 25.0.0
< 25.8.4
25.8.4
electron
npm/electron
npm
≥ 26.0.0
< 26.2.4
26.2.4
electron
npm/electron
npm
≥ 27.0.0-alpha.1
< 27.0.0-beta.8
27.0.0-beta.8

References

NVD — CVE-2023-5217 NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5217
Electron Source Repository REPOSITORY
https://github.com/electron/electron/pull/40022
Electron Source Repository REPOSITORY
https://github.com/electron/electron/pull/40023
Electron Source Repository REPOSITORY
https://github.com/electron/electron/pull/40024
Electron Source Repository REPOSITORY
https://github.com/electron/electron/pull/40025
Electron Source Repository REPOSITORY
https://github.com/electron/electron/pull/40026
Security Fix Commit FIX COMMIT
https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
Security Fix Commit FIX COMMIT
https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB
pastebin.com/tdkc4pdv WEB
https://pastebin.com/TdkC4pDv
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I
Electron Security Information SECURITY
https://security-tracker.debian.org/tracker/CVE-2023-5217
Electron Security Information SECURITY
https://security.gentoo.org/glsa/202310-04
Electron Security Information SECURITY
https://security.gentoo.org/glsa/202401-34
stackdiary.com/google-discloses-a-... WEB
https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217
support.apple.com/kb/ht213961 WEB
https://support.apple.com/kb/HT213961
support.apple.com/kb/ht213972 WEB
https://support.apple.com/kb/HT213972
twitter.com/maddiestone/status/... WEB
https://twitter.com/maddiestone/status/1707163313711497266
Electron Security Information SECURITY
https://www.debian.org/security/2023/dsa-5508
Electron Security Information SECURITY
https://www.debian.org/security/2023/dsa-5509
Electron Security Information SECURITY
https://www.debian.org/security/2023/dsa-5510
Electron Security Information SECURITY
https://www.mozilla.org/en-US/security/advisories/mfsa2023-44
Electron Security Information SECURITY
https://www.openwall.com/lists/oss-security/2023/09/28/5
Electron Security Information SECURITY
https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software
bugzilla.redhat.com/show_bug.cgi WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2241191
chromereleases.googleblog.com/2023/09/stable-chan... WEB
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
crbug.com/1486441 WEB
https://crbug.com/1486441
Electron Source Repository REPOSITORY
https://github.com/electron/electron
Electron Release RELEASE
https://github.com/electron/electron/releases/tag/v22.3.25
Electron Release RELEASE
https://github.com/electron/electron/releases/tag/v24.8.5
Electron Release RELEASE
https://github.com/electron/electron/releases/tag/v25.8.4
Electron Release RELEASE
https://github.com/electron/electron/releases/tag/v26.2.4
Electron Release RELEASE
https://github.com/electron/electron/releases/tag/v27.0.0-beta.8
Electron Release RELEASE
https://github.com/webmproject/libvpx/releases/tag/v1.13.1
Electron Source Repository REPOSITORY
https://github.com/webmproject/libvpx/tags
lists.debian.org/debian-lts-announce... WEB
https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
lists.debian.org/debian-lts-announce... WEB
https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
lists.debian.org/debian-lts-announce... WEB
https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV
lists.fedoraproject.org/archives/list/packa... WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD
seclists.org/fulldisclosure/2023... WEB
http://seclists.org/fulldisclosure/2023/Oct/12
seclists.org/fulldisclosure/2023... WEB
http://seclists.org/fulldisclosure/2023/Oct/16
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/28/5
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/28/6
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/29/1
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/29/11
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/29/12
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/29/14
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/29/2
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/29/7
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/29/9
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/30/1
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/30/2
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/30/3
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/30/4
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/09/30/5
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/10/01/1
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/10/01/2
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/10/01/5
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/10/02/6
Electron Security Information SECURITY
http://www.openwall.com/lists/oss-security/2023/10/03/11

Frequently Asked Questions

What is CVE-2023-5217?
CVE-2023-5217 is a security vulnerability in Electron involving Electron affected by libvpx's heap buffer overflow in vp8 encoding under CWE-787: Out-of-bounds Write.
Which Electron versions are affected?
Affected versions include releases prior to 22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8 across affected packages: electron.
What version fixes CVE-2023-5217?
Upgrading to 22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8 (or the latest patched release for your respective branch) resolves the vulnerability.
Is electron affected?
Yes, electron is affected in releases prior to 22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8. Upgrade your dependency to 22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8 or later.
What is the CVSS score of CVE-2023-5217?
CVE-2023-5217 has a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2023-5217?
CVE-2023-5217 is classified under CWE-787: Out-of-bounds Write (The product writes data past the end, or before the beginning, of the intended buffer.).
How can I check npm dependencies for CVE-2023-5217?
Run the dependency tree command: 'npm ls electron'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qqvq-6xgj-jw8g",
  "modified" : "2024-02-15T15:02:25Z",
  "published" : "2023-09-28T18:30:45Z",
  "aliases" : [ "CVE-2023-5217" ],
  "summary" : "Electron affected by libvpx's heap buffer overflow in vp8 encoding",
  "details" : "Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "electron"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "22.3.25"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "electron"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "24.0.0"
      }, {
        "fixed" : "24.8.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "electron"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "25.0.0"
      }, {
        "fixed" : "25.8.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "electron"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "26.0.0"
      }, {
        "fixed" : "26.2.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "electron"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "27.0.0-alpha.1"
      }, {
        "fixed" : "27.0.0-beta.8"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-5217"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/pull/40022"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/pull/40023"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/pull/40024"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/pull/40025"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/pull/40026"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I"
  }, {
    "type" : "WEB",
    "url" : "https://pastebin.com/TdkC4pDv"
  }, {
    "type" : "WEB",
    "url" : "https://security-tracker.debian.org/tracker/CVE-2023-5217"
  }, {
    "type" : "WEB",
    "url" : "https://security.gentoo.org/glsa/202310-04"
  }, {
    "type" : "WEB",
    "url" : "https://security.gentoo.org/glsa/202401-34"
  }, {
    "type" : "WEB",
    "url" : "https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217"
  }, {
    "type" : "WEB",
    "url" : "https://support.apple.com/kb/HT213961"
  }, {
    "type" : "WEB",
    "url" : "https://support.apple.com/kb/HT213972"
  }, {
    "type" : "WEB",
    "url" : "https://twitter.com/maddiestone/status/1707163313711497266"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5508"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5509"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5510"
  }, {
    "type" : "WEB",
    "url" : "https://www.mozilla.org/en-US/security/advisories/mfsa2023-44"
  }, {
    "type" : "WEB",
    "url" : "https://www.openwall.com/lists/oss-security/2023/09/28/5"
  }, {
    "type" : "WEB",
    "url" : "https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2241191"
  }, {
    "type" : "WEB",
    "url" : "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html"
  }, {
    "type" : "WEB",
    "url" : "https://crbug.com/1486441"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/electron/electron"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/releases/tag/v22.3.25"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/releases/tag/v24.8.5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/releases/tag/v25.8.4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/releases/tag/v26.2.4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/releases/tag/v27.0.0-beta.8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/webmproject/libvpx/releases/tag/v1.13.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/webmproject/libvpx/tags"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2023/Oct/12"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2023/Oct/16"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/28/5"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/28/6"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/29/1"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/29/11"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/29/12"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/29/14"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/29/2"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/29/7"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/29/9"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/30/1"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/30/2"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/30/3"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/30/4"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/09/30/5"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/01/1"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/01/2"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/01/5"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/02/6"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/03/11"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-787" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-10-05T17:31:47Z",
    "nvd_published_at" : "2023-09-28T16:15:10Z"
  }
}