CVE-2023-25362

What it actually does

Use-after-free in WebCore::RenderLayer::repaintBlockSelectionGaps leads to memory corruption that can be leveraged for remote code execution.

Why it matters to the business

Systems running affected connman packages on Debian and Ubuntu releases remain exposed to remote compromise for over three years after disclosure, increasing risk of unauthorized access and operational disruption across networks that rely on these distributions.

How an attack unfolds

An attacker supplies specially crafted content processed by WebKitGTK rendering paths used by connman, triggering the repaintBlockSelectionGaps function after an object has been freed, resulting in arbitrary code execution. Named threat actors associated with Apple product vulnerabilities have been linked to similar WebKit use-after-free issues.

How to fix it

Upgrade connman to the following fixed versions: Debian 11 to 1.36-2.2+deb11u2, Debian 12/13 to 1.41-3, Ubuntu 20.04 LTS to 1.36-2ubuntu0.1, Ubuntu 22.04 LTS to 1.36-2.3ubuntu0.1, Ubuntu Pro 18.04 LTS to 1.35-6ubuntu0.1~esm1, and Ubuntu Pro 16.04 LTS to 1.21-1.2+deb8u1ubuntu0.1~esm1.

How to confirm the fix worked

Verify installed connman package versions match or exceed the listed fixed releases for each distribution and confirm WebKitGTK components are updated beyond 2.36.8 where applicable.

Typical attack path

1. Identify a target running an affected connman package on Debian or Ubuntu
2. Deliver malicious content that exercises WebKitGTK rendering
3. Trigger the vulnerable repaintBlockSelectionGaps code path
4. Exploit the resulting use-after-free for code execution

How to detect it

Review system logs and package histories for signs of exploitation attempts against WebKitGTK rendering paths; correlate with known threat actor activity targeting Apple WebKit use-after-free flaws.

What your security team should do

• Apply the listed connman package updates immediately on all Debian 11/12/13 and Ubuntu 16.04/18.04/20.04/22.04 systems
• Prioritize patching for internet-facing or high-value hosts given the remote code execution impact
• Monitor for new WebKitGTK releases and audit any downstream dependencies on affected connman packages