CVE-2024-7531Time-of-check Time-of-use (TOCTOU) Race Condition in Mozilla Firefox

Severity
6.5MEDIUMNVD
EPSS
0.1%
top 80.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 6
Latest updateAug 21

Description

Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

CVEListV5mozilla/firefoxunspecified129
NVDmozilla/firefox< 129.0
CVEListV5mozilla/firefox_esrunspecified115.14+1
NVDmozilla/firefox_esr< 115.14.0+1
Ubuntumozilla/firefox< 129.0.1+build1-0ubuntu0.20.04.1

🔴Vulnerability Details

5
OSV
firefox regressions2024-08-21
OSV
firefox vulnerabilities2024-08-19
CVEList
CVE-2024-7531: Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor2024-08-06
OSV
CVE-2024-7531: Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor2024-08-06
GHSA
GHSA-3jj9-9269-99m2: Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor2024-08-06

📋Vendor Advisories

6
Ubuntu
Firefox vulnerabilities2024-08-19
Red Hat
mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines2024-08-06
Debian
CVE-2024-7531: firefox - Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input...2024
Mozilla
Mozilla Foundation Security Advisory 2024-34: CVE-2024-7531
Mozilla
Mozilla Foundation Security Advisory 2024-33: CVE-2024-7531
CVE-2024-7531 — Mozilla Firefox vulnerability | cvebase