CVE-2020-12419: 
NixOS vulnerability analysis and mitigation

CVE-2020-12419 is a high-severity use-after-free vulnerability discovered in Firefox and Thunderbird browsers. The vulnerability was identified in Firefox versions < 78, Firefox ESR < 68.10, and Thunderbird < 68.10.0. The issue was discovered by researcher worcester12345 and was disclosed on June 30, 2020 (Mozilla Advisory, Mozilla ESR Advisory).

The vulnerability occurs when processing callbacks during window flushing in the parent process, where the associated window may die, causing a use-after-free condition. This could lead to memory corruption and a potentially exploitable crash. Analysis of the crash report indicated that the issue stems from a race condition in the nsGlobalWindowInner component, specifically in the PromiseDocumentFlushedResolver::Call function (Mozilla Bug).

The vulnerability has a high severity rating with a CVSS 3.1 base score of 8.8. If successfully exploited, it could lead to memory corruption and potentially allow arbitrary code execution. However, the impact is somewhat limited as the vulnerability can only be triggered from the parent process and requires chrome-privileged access (Ubuntu Security).

The vulnerability requires chrome-privileged access to exploit, making it difficult to exploit in typical web browsing scenarios. The promiseDocumentFlushed method is a chrome-privileged method that can only be called on chrome windows, significantly limiting the attack surface (Mozilla Bug).

The vulnerability was fixed in Firefox 78.0, Firefox ESR 68.10, and Thunderbird 68.10.0. The fix involved adding a kungFuDeathGrip to hold a reference to the window that might die later when JavaScript runs. Users are advised to upgrade to these versions or later to mitigate the vulnerability (Red Hat Advisory, Mozilla Advisory).