CVE-2021-23960: 
NixOS vulnerability analysis and mitigation

CVE-2021-23960 is a security vulnerability discovered in Mozilla Firefox browsers and Thunderbird email client that was disclosed on January 26, 2021. The vulnerability affects Firefox versions below 85, Thunderbird versions below 78.7, and Firefox ESR versions below 78.7. The issue occurs when performing garbage collection on re-declared JavaScript variables, which results in a use-after-poison condition (Mozilla Advisory, NVD).

The vulnerability stems from a Shape being given a cross-zone pointer to a BaseShape, which should not occur as cross-zone edges are not properly handled. When garbage collection occurs that does not include the Shape's Zone, the BaseShape is not marked and gets freed incorrectly. This leads to a use-after-poison condition and potentially exploitable crash. The issue specifically manifests when a js::LexicalEnvironmentObject's shape runs Shape::cachify, creating a new owned BaseShape pointer in the wrong Zone. The vulnerability has a CVSS 3.1 Base Score of 8.8 (High) (Ubuntu CVE).

The vulnerability could result in a potentially exploitable crash when garbage collection is performed on re-declared JavaScript variables. While rated as moderate severity by Mozilla, the vulnerability has a high CVSS score of 8.8, indicating significant potential impact if successfully exploited. The issue requires user interaction and can be triggered through the browser's web console (Mozilla Advisory).

The vulnerability requires Debugger access and is primarily triggered through interactive commands in the web console. This makes it difficult to exploit through normal web content. The most straightforward way to trigger the vulnerability is by typing specific commands into the Firefox web console involving let and const declarations followed by garbage collection (Mozilla Bug).

The vulnerability was fixed in Firefox 85, Firefox ESR 78.7, and Thunderbird 78.7. The fix involves ensuring the correct compartment is entered before allocating BaseShape objects. Users should upgrade to these versions or newer to mitigate the vulnerability. The patch was designed to align with existing code paths that properly handle entering the Debuggee realm (Mozilla Advisory).