Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been able to make Google Chrome crash, and I was wondering if there are tools or heuristics to determine whether or not the crash is a security vulnerability.

How can I determine if a Chrome crash is also a security vulnerability?

share|improve this question
    
I'd be interested in seeing a crashdump. Could you post a stack trace, or the dump file? –  Polynomial Aug 1 '12 at 21:31
    
Where can I find the stack trace, or the dump file? –  Randomblue Aug 1 '12 at 21:34
    
Not sure on OSX. Try a Google for "OSX chrome crash dump location" or something similar. –  Polynomial Aug 2 '12 at 5:45

2 Answers 2

up vote 2 down vote accepted

I suggest reading Best way to triage crashes found via fuzzing, on Linux?, which describes exactly how to do a first-pass triage at assessing the likelihood that the crash is also a security problem. Tools like !exploitable and Valgrind memcheck are your friend.

If it passes the first-level check, the next step is probably to report it to the Chrome folks and let them evaluate it in greater detail.

share|improve this answer

Perhaps this post may help you, http://blog.chromium.org/2012/04/fuzzing-for-security.html. In particular, check out Address Sanitizer. Anyways, you need to analyze the crash file which is in various locations depending on distro. Have fun.

share|improve this answer
    
Thanks. Crash file? Could you point me to some documentation or some sort? –  Randomblue Aug 1 '12 at 21:07
    
What OS are you using? –  Richard Belisle Aug 1 '12 at 21:29
    
I'm using OS X 10.7 –  Randomblue Aug 1 '12 at 21:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.