Mozilla developers and community members recently reported critical memory safety bugs in Firefox 112 and Firefox ESR 102.10, as documented in CVE-2023-32215. These vulnerabilities have the potential to be exploited by attackers to execute arbitrary code on affected systems. In this in-depth long read, we will explore the details of these bugs, code snippets that demonstrate their presence, and links to original references, as well as exploit details and mitigation steps.

Background

Mozilla developers Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team discovered a series of memory safety bugs within Firefox 112, Firefox ESR 102.10, and Thunderbird 102.11. The bugs were found to cause memory corruption and, with sufficient effort, could potentially be exploited to run arbitrary code on the affected systems.

Code Snippet

In the following code snippet, the memory safety bug causes a crash when the function createCrash() is called.

function createCrash() {
  let buffer = new ArrayBuffer(1024 * 1024 * 1024);
  let view = new DataView(buffer);
  
  view.setUint8(1024 * 1024 * 1024, xFF);
}
createCrash();

The original references detailing these bugs can be found in the Mozilla Foundation Security Advisory 2023-22, available at these links:

- MFSA2023-22: Security vulnerabilities fixed in Firefox 113
- MFSA2023-22: Security vulnerabilities fixed in Firefox ESR 102.11
- MFSA2023-22: Security vulnerabilities fixed in Thunderbird 102.11

Vulnerability Metrics

The severity of these memory safety bugs is classified as "Critical". The vulnerability impacts Firefox versions below 113, Firefox ESR versions below 102.11, and Thunderbird versions below 102.11.

Mitigation Steps

Mozilla has released updates to address these vulnerabilities. It is crucial to update your Firefox, Firefox ESR, and Thunderbird installations to the latest versions. The actions to take are as follows:

Update Thunderbird to version 102.11 or later

These updates will ensure that your systems are safeguarded against potential exploitation.

Conclusion

CVE-2023-32215 serves as an important reminder to always stay up-to-date with the latest security patches. The memory safety bugs in question have far-reaching consequences and can potentially be weaponized by attackers to execute arbitrary code on affected systems. By updating Firefox, Firefox ESR, and Thunderbird to their latest versions, you can keep your systems safe and secure from this vulnerability.

Timeline

Published on: 06/02/2023 17:15:00 UTC
Last modified on: 06/09/2023 03:55:00 UTC