CVE-2024-2608: 
NixOS vulnerability analysis and mitigation

CVE-2024-2608 is a high-severity integer overflow vulnerability discovered in Mozilla Firefox, Firefox ESR, and Thunderbird. The vulnerability was identified in the functions AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding(), and AppendEncodedCharacters(), which could experience integer overflows leading to buffer underallocation and subsequent out-of-bounds write operations. This vulnerability affects Firefox versions prior to 124, Firefox ESR versions prior to 115.9, and Thunderbird versions prior to 115.9 (Mozilla Advisory).

The vulnerability occurs when the affected functions perform additions of uint32_t values, particularly lengths derived from strings, without proper overflow checks. When StringBuilder::ToString() is called to obtain the resulting string, the integer overflow causes underallocation of an output buffer, leading to out-of-bounds write operations. The write occurs in a content process and can contain arbitrary attacker-provided data intermixed with repeated escape sequences. The vulnerability requires the sum of attacker-provided data length and repeated strings length to be >= 0x100000000 (Mozilla Bug).

The vulnerability has been rated as high impact. If successfully exploited, it could lead to memory corruption and potentially allow an attacker to execute arbitrary code. The out-of-bounds write operation could corrupt heap memory, potentially leading to program crashes or more severe security implications (Mozilla Advisory).

The vulnerability was discovered and reported by security researcher Ronald Crane. While proof-of-concept code exists demonstrating the vulnerability, there have been no reported instances of this vulnerability being exploited in the wild. Testing showed that exploitation could lead to crashes in both the ToString() thread and other threads, with varying reliability depending on system configuration (Mozilla Bug).

The vulnerability has been fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. Users are strongly advised to update to these versions or later. The fix involved implementing proper integer overflow checks and improving the handling of string length calculations. For Debian systems, fixed packages have been released in version 115.9.0-1~deb10u1 for Thunderbird and 115.9.1esr-1~deb10u1 for Firefox-ESR (Debian Advisory, Debian ESR Advisory).