Cyber Resilience

CVE-2024-3833

Fedoraproject Fedora 38 … 40

Public PoC
Published
17 April 2024
Modified
19 December 2024
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.15 96th percentile
Risk Priority 75 floored blend · peak EPSS

Summary

CVE-2024-3833 is a high-severity Passing Mutable Objects to an Untrusted Method (CWE-374) vulnerability in Fedoraproject Fedora. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)

CWE(s)
NVD-CWE-noinfoCWE-374

Related Threats

CVEs Like This One

CVE-2024-2885Same product: Fedoraproject Fedora
CVE-2024-4761Same product: Fedoraproject Fedora
CVE-2024-1669Same product: Fedoraproject Fedora
CVE-2024-0805Same product: Fedoraproject Fedora
CVE-2021-21206Same product: Fedoraproject Fedora
CVE-2021-21220Same product: Fedoraproject Fedora
CVE-2024-5838Same product: Fedoraproject Fedora
CVE-2024-5833Same product: Fedoraproject Fedora
CVE-2024-1670Same product: Fedoraproject Fedora
CVE-2024-1938Same product: Fedoraproject Fedora

Affected Assets

google
chrome
≤ 124.0.6367.60
fedoraproject
fedora
38, 39, 40

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-8 Security and Privacy Engineering Principles partial match

Secure-engineering principles include defensive copying and trust-boundary hygiene that eliminate the weakness at design time.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce cloning or defensive copying before passing mutable objects to untrusted callers.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle practices can mandate defensive copying of mutable objects before passing them to untrusted code.

A.8.26 Application security requirements partial match
prevents

Application security requirements can explicitly require defensive copies or immutability when data crosses trust boundaries.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include isolating mutable state and avoiding shared references across trust boundaries.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly address CWE-374 by requiring defensive copies or immutable interfaces when calling untrusted methods.

References