CVE-2021-23962: 
NixOS vulnerability analysis and mitigation

CVE-2021-23962 is a vulnerability discovered in Firefox versions prior to 85, reported by Chiaki ISHIKAWA. The vulnerability stems from incorrect use of the 'RowCountChanged' method in the nsTreeBodyFrame component, which could lead to a use-after-poison condition (Mozilla Advisory, NVD).

The vulnerability occurs in the nsTreeBodyFrame::RowCountChanged function where improper handling of memory management could result in accessing already freed (poisoned) memory. The issue specifically involves the mUpdateBatchNest member variable being accessed after the memory has been invalidated. The vulnerability was rated with a low severity impact by Mozilla (Mozilla Advisory).

The vulnerability could potentially lead to a crash of the Firefox browser and under specific circumstances might be exploitable. The impact was considered low severity in the context of Firefox's security model (Mozilla Advisory).

While the vulnerability could result in a potentially exploitable crash, no known exploits were reported in the wild. The use-after-poison condition required specific circumstances to trigger, making practical exploitation challenging (Mozilla Advisory).

The vulnerability was fixed in Firefox version 85. Users were advised to upgrade to this version or later to receive the security fix. The fix involved implementing proper memory management checks using AutoWeakFrame to validate pointer validity before accessing potentially invalidated memory (Mozilla Advisory).