CVE-2021-29952: 
NixOS vulnerability analysis and mitigation

CVE-2021-29952 is a race condition vulnerability discovered in Firefox's Web Render components. The vulnerability was disclosed on May 5, 2021, affecting Firefox versions prior to 88.0.1 and Firefox for Android versions prior to 88.1.3. When Web Render components were destructed, a race condition could have caused undefined behavior (Mozilla Advisory).

The vulnerability is classified as a race condition (CWE-362) with a CVSS v3.1 base score of 7.5 (HIGH). The technical issue occurs when WebRenderBridgeParent::RecvShutdownSync() causes WebRenderBridgeParent::ClearResources() to run on the compositor thread, racing with the use of WebRender data structure on a WRScene~ilder thread (Bugzilla).

The race condition could potentially lead to undefined behavior and, with sufficient effort, could be exploited to execute arbitrary code. The vulnerability was rated as having a high impact by Mozilla's security team (Mozilla Advisory).

The vulnerability could occur during window closure or system shutdown. While rated as having high impact, the exploitation would require significant effort due to the nature of the race condition. The vulnerability was discovered through ThreadSanitizer analysis during fuzzing of the mozilla-central build (Bugzilla).

The vulnerability was patched in Firefox 88.0.1 and Firefox for Android 88.1.3. Users should update to these versions or later to mitigate the risk. The fix involved moving more work to the compositor thread to avoid potential races (Mozilla Advisory).