CVE-2020-12388: 
NixOS vulnerability analysis and mitigation

CVE-2020-12388 is a critical security vulnerability discovered in Firefox that affects Windows operating systems. The vulnerability was discovered by James Forshaw of Google Project Zero and disclosed on May 5, 2020. The issue affects Firefox versions < 76 and Firefox ESR < 68.8, where the Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape (Mozilla Advisory, NVD).

The vulnerability stems from insufficient access control in Firefox content processes running at USER_LIMITED token level. When a content process is compromised, it can wait for a new content process to be created and open it before the initial thread token is dropped with the call to LowerToken. This allows the process to run as USER_RESTRICTED_SAME_ACCESS, which despite running at Low Integrity Level, is sufficient to escape the sandbox. The exploit chain involves suspending new processes, impersonating the main thread's initial token, creating an out-of-process COM server, and ultimately achieving privilege escalation (Project Zero).

The vulnerability allows an attacker to escape Firefox's sandbox protection on Windows systems. Through a successful exploit, an attacker could elevate privileges and execute arbitrary code outside the sandboxed environment, potentially gaining access to the underlying system with the user's privileges (Mozilla Advisory).

A proof-of-concept exploit was developed demonstrating the complete sandbox escape. The exploit chain involves multiple steps including process suspension, token impersonation, and COM server creation to achieve privilege escalation. The vulnerability was confirmed to be exploitable on Firefox 73.0.1 and 75.0a1 64-bit versions running on Windows 10 1809/1909 (Project Zero).

Mozilla addressed this vulnerability by implementing fixes in Firefox 76 and Firefox ESR 68.8. The fix involves using SetLockdownDefaultDacl and AddRestrictingRandomSid in sandbox policies to restrict access between content processes. For users running Firefox from network drives, additional mitigations were implemented to maintain security despite potential performance impacts (Mozilla Advisory).