CVE-2022-26387Time-of-check Time-of-use (TOCTOU) Race Condition in Mozilla Firefox

Severity
7.5HIGHNVD
OSV8.8
EPSS
0.1%
top 70.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 22

Description

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages9 packages

CVEListV5mozilla/firefoxunspecified98
NVDmozilla/firefox< 98.0
CVEListV5mozilla/firefox_esrunspecified91.7
Ubuntumozilla/firefox< 98.0.1+build2-0ubuntu0.18.04.1+5

🔴Vulnerability Details

7
GHSA
GHSA-w44g-v7w6-xpcv: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-2022-12-22
OSV
CVE-2022-26387: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-2022-12-22
CVEList
CVE-2022-26387: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-2022-12-22
OSV
firefox regressions2022-03-24
OSV
thunderbird vulnerabilities2022-03-23

📋Vendor Advisories

9
Ubuntu
Firefox regressions2022-03-24
Ubuntu
Thunderbird vulnerabilities2022-03-23
Ubuntu
Firefox vulnerabilities2022-03-17
Ubuntu
Firefox vulnerabilities2022-03-10
Red Hat
Mozilla: Time-of-check time-of-use bug when verifying add-on signatures2022-03-08
CVE-2022-26387 — Mozilla Firefox vulnerability | cvebase