Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
1

I have been able to make Google Chrome crash, and I was wondering if there are tools or heuristics to determine whether or not the crash is a security vulnerability.

How can I determine if a Chrome crash is also a security vulnerability?

share|improve this question
I'd be interested in seeing a crashdump. Could you post a stack trace, or the dump file? – Polynomial Aug 1 '12 at 21:31
Where can I find the stack trace, or the dump file? – Justin Aug 1 '12 at 21:34
Not sure on OSX. Try a Google for "OSX chrome crash dump location" or something similar. – Polynomial Aug 2 '12 at 5:45

2 Answers

up vote 2 down vote accepted

I suggest reading Best way to triage crashes found via fuzzing, on Linux?, which describes exactly how to do a first-pass triage at assessing the likelihood that the crash is also a security problem. Tools like !exploitable and Valgrind memcheck are your friend.

If it passes the first-level check, the next step is probably to report it to the Chrome folks and let them evaluate it in greater detail.

share|improve this answer
up vote 1 down vote

Perhaps this post may help you, http://blog.chromium.org/2012/04/fuzzing-for-security.html. In particular, check out Address Sanitizer. Anyways, you need to analyze the crash file which is in various locations depending on distro. Have fun.

share|improve this answer
Thanks. Crash file? Could you point me to some documentation or some sort? – Justin Aug 1 '12 at 21:07
What OS are you using? – Richard Belisle Aug 1 '12 at 21:29
I'm using OS X 10.7 – Justin Aug 1 '12 at 21:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.