CVE-2024-38312: 
NixOS vulnerability analysis and mitigation

CVE-2024-38312 is a security vulnerability affecting Firefox for iOS versions below 127, discovered by Adam Berry. The vulnerability relates to private browsing data persistence, where certain browsing data such as location history and webpage thumbnails could be incorrectly retained within the sandboxed app bundle after application termination, despite being in private browsing mode (Mozilla Advisory).

The vulnerability stems from Firefox for iOS incorrectly handling the cleanup of private browsing session data. Specifically, tab session data files and tab screenshots from private browsing sessions were being stored within the app container and not properly cleared upon session termination. The vulnerability has been assigned a CVSS 3.1 score of 6.5 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (Ubuntu CVE).

The vulnerability could lead to the disclosure of private browsing history, as the persisted data includes screenshots of visited websites and files containing URLs from private browsing sessions. This data could be exposed through device backups, including those stored on PCs, portable drives, or cloud storage, potentially compromising user privacy (Mozilla Bugzilla).

While the vulnerability requires access to the device's storage or backups to exploit, the risk is heightened because the data could be accessed through various means, including device backups, cloud storage compromises, or physical device access. The data is stored locally within the app container and is not synced through Mozilla's services, but could be included in device backups (Mozilla Bugzilla).

The vulnerability has been fixed in Firefox for iOS version 127. The fix includes changes to prevent the persistence of private tab session data and ensures proper cleanup of tab screenshots during app launch. Users are advised to update to Firefox for iOS version 127 or later to protect against this vulnerability (Mozilla Advisory).