CVE-2020-12388
published 2020-05-26CVE-2020-12388: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on…
PriorityP352critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
3.52%
89.2th percentile
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| debian | firefox-esr | — | — |
| mozilla | firefox | < 76.0 | 76.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= unspecified < 76 | 76 |
| mozilla | firefox_esr | < 68.8.0 | 68.8.0 |
| mozilla | firefox_esr | >= unspecified < 68.8 | 68.8 |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv10.0CRITICAL
vendor_debian10.0LOW
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fx7p-g7cp-xx65: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape
ghsa_unreviewed·2022-05-24
CVE-2020-12388 [HIGH] CWE-20 GHSA-fx7p-g7cp-xx65: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
Project0
FF Sandbox Escape (CVE-2020-12388) - Project Zero
project_zero·2020-06-01·CVSS 10.0
CVE-2020-12388 [CRITICAL] FF Sandbox Escape (CVE-2020-12388) - Project Zero
By James Forshaw, Project Zero
In my previous blog post I discussed an issue with the Windows Kernel’s handling of Restricted Tokens which allowed me to escape the Chrome GPU sandbox. Originally I’d planned to use Firefox for the proof-of-concept as Firefox uses the same effective sandbox level as the Chrome GPU process for its content renderers. That means a FF content RCE would give code execution in a sandbox where you could abuse the Windows Kernel Restricted Tokens issue, making it much more serious.
However, while researching the sandbox escape I realized that was the least of FF’s worries. The use of the GPU level sandbox for multiple processes introduced a sandbox escape vector, even once the Windows issue was fixed. This blog post is about the specific behavior of the Chromium
OSV
CVE-2020-12388: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape
osv·2020-05-26·CVSS 10.0
CVE-2020-12388 [CRITICAL] CVE-2020-12388: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
Red Hat
Mozilla: Sandbox escape with improperly guarded Access Tokens
vendor_redhat·2020-05-05·CVSS 10.0
CVE-2020-12388 [CRITICAL] CWE-284 Mozilla: Sandbox escape with improperly guarded Access Tokens
Mozilla: Sandbox escape with improperly guarded Access Tokens
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
The Mozilla Foundation Security Advisory describes this flaw as:
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.
Statement: This issue only affects Firefox on Windows operating systems. Firefox on Linux is not affected.
Package: firefox (Red Hat Enterprise Linux 5) - Out of support scope
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Pac
Debian
CVE-2020-12388: firefox - The Firefox content processes did not sufficiently lockdown access control which...
vendor_debian·2020·CVSS 10.0
CVE-2020-12388 [CRITICAL] CVE-2020-12388: firefox - The Firefox content processes did not sufficiently lockdown access control which...
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2020-17: CVE-2020-12388
vendor_mozilla·CVSS 10.0
CVE-2020-12388 [CRITICAL] Mozilla Foundation Security Advisory 2020-17: CVE-2020-12388
Mozilla Foundation Security Advisory 2020-17
CVE: CVE-2020-12388
Product: Firefox ESR
Impact: critical
Fixed in: Firefox ESR 68.8
Mozilla
Mozilla Foundation Security Advisory 2020-16: CVE-2020-12388
vendor_mozilla·CVSS 10.0
CVE-2020-12388 [CRITICAL] Mozilla Foundation Security Advisory 2020-16: CVE-2020-12388
Mozilla Foundation Security Advisory 2020-16
CVE: CVE-2020-12388
Product: Firefox
Impact: high
Fixed in: Firefox 76
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-12388 Mozilla: Sandbox escape with improperly guarded Access Tokens
bugzilla·2020-05-06·CVSS 10.0
CVE-2020-12388 [CRITICAL] CVE-2020-12388 Mozilla: Sandbox escape with improperly guarded Access Tokens
CVE-2020-12388 Mozilla: Sandbox escape with improperly guarded Access Tokens
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.
*Note: this issue only affects Firefox on Windows operating systems.*
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2020-17/#CVE-2020-12388
Discussion:
Acknowledgments:
Name: the Mozilla project
Upstream: James Forshaw (Google Project Zero)
---
Statement:
This issue only affects Firefox on Windows operating systems. Firefox on Linux is not affected.
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-12388
Bugzilla
Firefox: Default Content Process DACL Sandbox Escape
bugzilla·2020-02-28
[MEDIUM] Firefox: Default Content Process DACL Sandbox Escape
Firefox: Default Content Process DACL Sandbox Escape
Created attachment 9129793
Proof of Concept Visual Studio Project
Firefox: Default Content Process DACL Sandbox Escape
Platform: Firefox 73.0.1 and 75.0a1, 64-bit on Windows 10 1809/1909 (not tested earlier OS versions).
Class: Elevation of Privilege
Summary: The Firefox content processes do not sufficiently lockdown access control which can result in a sandbox escape.
Description:
According to https://wiki.mozilla.org/Security/Sandbox the current content process sandbox is Level 5 which runs with Chromium token level of USER_LIMITED. However, USER_LIMITED is sufficient to open any of the other content processes running at the same time.
The ability to open another process presents a problem, the initial token is set to USER_RESTRI
http://packetstormsecurity.com/files/157860/Firefox-Default-Content-Process-DACL-Sandbox-Escape.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=1618911https://www.mozilla.org/security/advisories/mfsa2020-16/https://www.mozilla.org/security/advisories/mfsa2020-17/http://packetstormsecurity.com/files/157860/Firefox-Default-Content-Process-DACL-Sandbox-Escape.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=1618911https://www.mozilla.org/security/advisories/mfsa2020-16/https://www.mozilla.org/security/advisories/mfsa2020-17/
2020-05-26
Published