CVE-2023-6860: 
NixOS vulnerability analysis and mitigation

The CVE-2023-6860 vulnerability was discovered in Mozilla Firefox's VideoBridge component, affecting Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. The vulnerability was disclosed on December 19, 2023, and allows any content process to use textures produced by remote decoders, which could potentially be abused to escape the sandbox (Mozilla Advisory).

The vulnerability exists in the VideoBridge component where the compositor process uses SurfaceDescriptorRemoteDecoder, containing a source ID and handle, to link a TextureHost created by a helper process to a TextureHost created by a content process during display list building. The system accepts the opaque source/handle without additional validation, where the source ID only indicates which utility process created it, not the process that requested it. The CVSS v3.1 base score is 6.5 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (NVD).

The vulnerability could allow a compromised content process to use arbitrary IDs and potentially inject video content as though it was coming from another content process. While the attacker cannot read content from other processes, they could display content intended for another unexploited content process, potentially leading to user confusion or deception (Mozilla Bug).

The vulnerability has been fixed in Firefox ESR 115.6, Thunderbird 115.6, and Firefox 121. Users are strongly recommended to upgrade to these versions or later. The fix involves implementing token validation where the utility process generates namespace IDs for each content process, shares that with the compositor process, and only allows wrapper textures created by the owning content process to wrap the actual texture from the VideoBridge (Mozilla Advisory).

Multiple Linux distributions have issued security advisories and patches for this vulnerability, including Debian (DSA-5581-1 and DSA-5582-1) and Gentoo (GLSA-202401-10). The vulnerability has been rated as moderate severity by Mozilla and various security organizations (Debian Security, Gentoo Security).