CVE-2021-23954: 
NixOS vulnerability analysis and mitigation

A high-severity vulnerability (CVE-2021-23954) was discovered in Mozilla Firefox's JavaScript engine that affected Firefox versions < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. The vulnerability was related to the use of logical assignment operators in JavaScript switch statements, which could cause type confusion leading to memory corruption and potentially exploitable crashes (Mozilla Advisory, NVD).

The vulnerability occurred when using the new logical assignment operators in JavaScript switch statements. This could trigger a type confusion where the JS_UNINITIALIZED_LEXICAL magic value would escape to user code, leading to memory corruption. The issue manifested in two ways: either through an assertion failure in the interpreter or through memory corruption when handling type conversions. The vulnerability received a CVSS v3 score of 8.8 (High) (Red Hat CVE, Mozilla Bug).

The vulnerability could result in memory corruption and potentially exploitable crashes. When exploited, it could lead to type confusion issues where magic values could escape to user code, potentially allowing for arbitrary code execution. The impact was considered high severity due to the potential for memory corruption and the broad attack surface provided by the JavaScript engine (Mozilla Advisory).

The vulnerability was considered highly exploitable due to its location in the JavaScript engine and the relatively simple trigger condition using logical assignment operators in switch statements. While no public exploits were confirmed, the bug could be triggered through specifically crafted JavaScript code, leading to memory corruption and crashes (Mozilla Bug).

The vulnerability was fixed in Firefox 85, Firefox ESR 78.7, and Thunderbird 78.7. The fix involved adding a new TDZCheckCache (Temporal Dead Zone Check Cache) when emitting bytecode for short-circuit assignments (||=, &&=, and ??=) to ensure proper handling of uninitialized lexical bindings (Mozilla Advisory, Mozilla Bug).