# Uncovering a ChromeOS remote memory corruption vulnerability

Unbounded strcpy of D-Bus SetPlayerIdentity into 128-byte heap buffer in ChromeOS CRAS, reachable via browser or Bluetooth audio metadata, enabling DoS/RCE.

- Payout: unconfirmed
- Severity: critical
- Program: Google
- Credited: Microsoft 365 Defender Research Team
- Disclosed: 2022-08-19
- CVE: CVE-2022-2587
- Write-up quality: 7/10
- Original: https://www.microsoft.com/security/blog/2022/08/19/uncovering-a-chromeos-remote-memory-corruption-vulnerability/
- Library page: https://bugbountylibrary.com/r/blog%3Amicrosoft-com-security-blog-2022-08-19-uncovering-a-chromeos-remote-memory-corruption-vulnerability
- Tags: domain:desktop impact:dos impact:rce kind:research platform:threat-intel sev:critical tech:linux technique:recon technique:source-review vuln:dos vuln:memory-corruption

**Target:** ChromeOS CRAS D-Bus service (org.chromium.cras)
**Root cause:** handle_set_player_identity passes the user-controlled identity string to cras_bt_player_update_identity, which strcpy's it into player.identity, a 128-byte malloc'd heap buffer, with no bounds check.
**Steps:**
1. Enumerate D-Bus services: `dbus-send --system --dest=org.freedesktop.DBus --type=method_call --print-reply /org/freedesktop/DBus org.freedesktop.DBus.ListNames`
2. Introspect org.chromium.cras: `dbus-send --system --dest=org.chromium.cras --type=method_call --print-reply /org/chromium/cras org.freedesktop.DBus.Introspectable.Introspect`
3. Send oversized identity: `dbus-send --system --dest=org.chromium.cras --type=method_call --print-reply /org/chromium/cras org.chromium.cras.Control.SetPlayerIdentity string:AAAA...(>128 bytes)`
4. Without dev mode, trigger via MediaSessionMetadataChanged by changing song title metadata in browser or from paired Bluetooth device
**How found:** After prior D-Bus research on Linux, enumerated ChromeOS D-Bus services via Introspectable interface, prioritized methods accepting arbitrarily large string/array inputs, and flagged strcpy in cras_bt_player_update_identity as an unbounded copy into a malloc(128) buffer.
**Exploitation:** Attacker lures victim to play a song with crafted title metadata in the browser, or pairs a Bluetooth device sending crafted metadata; CRAS copies the oversized identity into the 128-byte heap buffer, corrupting heap. AiTM could also deliver it remotely. Full RCE requires precise heap grooming and chaining with other bugs; otherwise DoS.
**Escalation:** Heap corruption could be escalated to RCE by grooming chunks via media metadata manipulation and chaining with additional vulnerabilities.
**Insight:** D-Bus services exposing Introspectable let you enumerate methods without source; prioritize methods taking unbounded strings/arrays, then trace callers upward (here MediaSessionMetadataChanged) to find remote, unauthenticated trigger paths like media metadata.