Google: Half of 2022’s Zero-Days Are Variants of Previous Vulnerabilities

Google Project Zero has observed a total of 18 exploited zero-day vulnerabilities in the first half of 2022, at least half of which exist because previous bugs were not properly addressed.

According to Google Project Zero researcher Maddie Stone, nine of the in-the-wild zero-days seen so far this year could have been prevented had organizations applied more comprehensive patching.

“On top of that, four of the 2022 zero-days are variants of 2021 in-the-wild zero-days. Just 12 months from the original in-the-wild zero-day being patched, attackers came back with a variant of the original bug,” Stone says.

The most recent of these issues is the Follina vulnerability in the Windows platform. Tracked as CVE-2022-30190, it is a variant of an MSHTML zero-day tracked as CVE-2021-40444.

CVE-2022-21882 is another Windows vulnerability that is a variant of an in-the-wild zero-day that was improperly resolved last year, namely CVE-2021-1732.

An iOS IOMobileFrameBuffer bug (CVE-2022-22587) and a type confusion flaw in Chrome’s V8 engine (CVE-2022-1096) are two other zero-days that are variants of exploited security flaws found last year – CVE-2021-30983 and CVE-2021-30551, respectively.

Other 2022 zero-days that are variants of improperly addressed security defects are CVE-2022-1364 (Chrome), CVE-2022-22620 (WebKit), CVE-2021-39793 (Google Pixel), CVE-2022-26134 (Atlassian Confluence), and CVE-2022-26925 (Windows flaw called PetitPotam).

“In the case of the Windows win32k [CVE-2022-21882] and the Chromium property access interceptor [CVE-2022-1096] bugs, the execution flow that the proof-of-concept exploits took were patched, but the root cause issue was not addressed: attackers were able to come back and trigger the original vulnerability through a different path,” Stone explains.

The WebKit and PetitPotam issues emerged because, although the original vulnerabilities had been addressed, they were regressed at some point, which allowed the attackers to exploit the same bugs again.

“When 0-day exploits are detected in-the-wild, it’s the failure case for an attacker. It’s a gift for us security defenders to learn as much as we can and take actions to ensure that that vector can’t be used again,” Stone notes.

Recommendations for ensuring that vulnerabilities are correctly and comprehensively fixed include the analysis of their root cause and how they were introduced, analysis of vulnerabilities that are similar to the security issue at hand, and the analysis of the employed exploit techniques and of the patch.

“Transparently sharing these analyses helps the industry as a whole as well. This allows developers and security professionals to better understand what the attackers already know about these bugs, which hopefully leads to even better solutions and security overall,” Stone concludes.

Related: Google Patches Third Actively Exploited Chrome Zero-Day of 2022

Related: Patch Tuesday: Microsoft Warns of New Zero-Day Being Exploited

Related: Emergency Firefox Update Patches Two Actively Exploited Zero-Day Vulnerabilities