CVE-2022-31742: 
NixOS vulnerability analysis and mitigation

CVE-2022-31742 is a security vulnerability affecting Mozilla Firefox < 101, Firefox ESR < 91.10, and Thunderbird < 91.10. The vulnerability was discovered by a researcher named Michal and disclosed in May 2022. It involves a timing attack vulnerability in the WebAuthn implementation that could allow attackers to leak cross-origin information (Mozilla Advisory).

The vulnerability stems from a timing attack that can be exploited by sending a large number of allowCredential entries to a WebAuthn token and detecting the time difference between invalid key handles and cross-origin key handles. The vulnerability has a CVSS v3.1 base score of 6.5 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) (NVD).

If exploited, this vulnerability could lead to cross-origin account linking in violation of WebAuthn security goals. This presents a privacy risk as it allows attackers to potentially track users across different origins, which WebAuthn was specifically designed to prevent (Mozilla Advisory).

The vulnerability was fixed by implementing limits on the number of allowed key handles in the allowCredentials list on the client side. This fix was released in Firefox 101, Firefox ESR 91.10, and Thunderbird 91.10. The same issue was previously identified and fixed in Chromium under CVE-2021-38022 (Bugzilla).