CVE-2024-2605: 
NixOS vulnerability analysis and mitigation

CVE-2024-2605 is a high-impact security vulnerability affecting Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9 on Windows operating systems. The vulnerability was discovered by researcher goodbyeselene and disclosed on March 19, 2024. It allows an attacker to leverage the Windows Error Reporter to potentially run arbitrary code on the system by escaping the sandbox (Mozilla Advisory).

The vulnerability stems from a process type confusion in the Windows Error Reporter (WER) implementation. When a Firefox process throws an exception that must be handled out-of-process, WER spawns a process loading mozwer.dll. The vulnerability allows a compromised content process to pose as a browser process by modifying internal memory structures, specifically the gInProcessWerData.mProcessType value. This confusion leads to the execution of handle_main_process_crash instead of handle_child_process_crash, potentially allowing sandbox escape. The vulnerability is partially mitigated by Windows' win32k lockdown feature when enabled (Bugzilla).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code outside the sandbox environment on Windows systems. However, the actual impact is significantly limited by Windows' win32k lockdown feature, which prevents the exploit from working in standard configurations. The vulnerability is particularly relevant in virtual machine environments where win32k lockdown might be disabled (Security Online).

The vulnerability requires specific conditions to be exploitable, primarily the absence of win32k lockdown protection. This is most commonly encountered in virtual machine environments or systems with certain graphics driver configurations. The exploit involves manipulating environment variables and process type information to trick the Windows Error Reporter into executing arbitrary code (Bugzilla).

Mozilla has addressed this vulnerability in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. The fix involves changing how processes are identified in WER and preventing trust in data read from crashed processes. Users are strongly advised to update to these versions or later. Additionally, ensuring win32k lockdown is enabled provides an effective mitigation against this vulnerability (Mozilla Advisory).