CVE-2020-6796: 
NixOS vulnerability analysis and mitigation

A critical security vulnerability (CVE-2020-6796) was discovered in Mozilla Firefox versions prior to 73 and Firefox ESR versions prior to 68.5. The vulnerability was identified and reported by Thomas Imbert in February 2020. It involved a missing bounds check in the parent process's shared memory handling related to crash reporting functionality (Mozilla Advisory, NVD).

The vulnerability stems from a lack of validation on array indices when reading shared memory in the CrashReporterMetadataShmem::ReadAppNotes function. A content process could modify shared memory relating to crash reporting information and trigger an out-of-bounds write operation. The issue was assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating high impact on confidentiality, integrity, and availability (NVD).

The vulnerability could lead to memory corruption and potentially exploitable crashes. If successfully exploited, it could allow an attacker to execute arbitrary code with the privileges of the Firefox process, effectively escaping the browser's sandbox protection. This could potentially lead to complete system compromise (Mozilla Advisory, Gentoo Advisory).

The vulnerability requires user interaction to trigger, as an attacker would need to convince a user to visit a malicious website. The exploit process involves modifying shared memory related to crash reporting and triggering a crash in the content process, which then leads to the out-of-bounds write in the parent process. A proof-of-concept exploit was developed demonstrating the vulnerability (Bugzilla).

The vulnerability was fixed in Firefox 73.0 and Firefox ESR 68.5. Users are advised to upgrade to these or later versions. The fix involved adding proper bounds checking to prevent out-of-bounds access in the shared memory handling code. Various Linux distributions also released security updates to address this vulnerability (Ubuntu Notice, Gentoo Advisory).