-1

There have been numerous reports in the last week about the Chrome exploit using a bug in the FreeType library. According to reports, this bug was found on 2020-10-19. https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html https://securityaffairs.co/wordpress/109823/hacking/chrome-cve-2020-15999-zero-day.html https://nakedsecurity.sophos.com/2020/10/21/chrome-zero-day-in-the-wild-patch-now/ (and many other links)

However, the CVE entry for this was created on 2020-07-27: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999

Am I missing something about how these numbers are issued?

Thanks.

Improve this question
5
  • I'm not sure how your confusion relates to the numbers, when you are referencing the various dates things were recorded.
    – schroeder ♦
    Oct 25, 2020 at 13:46
  • 2
    You are assuming that the CVE is assigned when announced, but the link to the CVE you provided clearly explains that the number is reserved prior to announcement. It is perfectly reasonable to assume that the flaw was discovered in July, Project Zero reserved the CVE number, they continued research to get a better understanding of its impact and scope, then announced their findings in October. The finding of the Zero Day being exploited is a separate timeline.
    – schroeder ♦
    Oct 25, 2020 at 13:52
  • Where does Google say that the zero-day exploit was found in October? Oct 19 was when they announced it. All in all, I think you are misinterpreting and misreading the links you found.
    – schroeder ♦
    Oct 25, 2020 at 13:54
  • Without having checked the links - big vendors regularly get assigned CVE ranges which they can fill up themselves later. I'm guessing this saves the roundtrip of request and approval.
    – Arminius
    Oct 26, 2020 at 9:43
  • I was confused by several things. In the release notes, Google says the bug was "reported on 10-19". I guess that could be different than "found". Also, some of the new articles about it praised Google for fixing the bug the day after it was reported, which led me to believe that it had been found on the 19th (I should have checked the source). So, based on what you guys are saying, the bug was actually reported to Mitre (and a CVE created) on July 27th, but perhaps the 10-19 report was from the "in-the-wild" use of the exploit.
    – Brad Silva
    Oct 26, 2020 at 23:40

1 Answer 1

Reset to default
2

In times like this, you should look at the Assigning CNA.

Assigning CNA
Chrome

As can be seen from Mitre's Request CVE page, Chrome is a CNA and thus they can reserve blocks of CVE IDs for themselves before a vulnerability is discovered. You can read more details on how this is done from this official pdf by Mitre.

In short, nothing is strange with the CVE record. The bug was found on 2020-10-19 as is stated in the CVE details, but the CVE number was probably assigned in a block to Chrome CNA (a part of Google) on 2020-07-27.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.