CVE-2024-4772: 
NixOS vulnerability analysis and mitigation

CVE-2024-4772 is a security vulnerability discovered in Firefox versions prior to 126, where an HTTP digest authentication nonce value was generated using the rand() function, which could lead to predictable values. The vulnerability was reported by security researcher Hanno Böck and was fixed in Firefox 126, released in May 2024 (Mozilla Advisory, NVD).

The vulnerability stems from the use of the insecure rand() function to generate random nonce values in HTTP digest authentication. The affected code was located in nsHttpDigestAuth.cpp, where a cnonce (client nonce) value was generated using the rand() function instead of a cryptographically secure random number generator. The vulnerability has been assigned a CVSS 3.1 Base Score of 5.9 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (NVD).

The vulnerability could potentially lead to information leakage about the state of the rand() RNG to an attacker. While classified as low severity by Mozilla, the predictable nonce values could potentially compromise the security of HTTP digest authentication mechanisms. The exact security impact was not fully determined, but it could affect the overall security of the authentication process (Mozilla Bug).

The vulnerability was rated with a low impact by Mozilla's security team. There are no known reports of this vulnerability being exploited in the wild. The exploitation would require understanding the inner workings of the HTTP Digest authentication protocol and the ability to predict or manipulate the generated nonce values (Mozilla Advisory).

The vulnerability was fixed in Firefox 126 by replacing the insecure rand() function with PK11_GenerateRandom, a secure random number generator. Users are advised to upgrade to Firefox 126 or later versions to receive the security fix. The fix has been implemented in the main release branch and backported to supported versions (Mozilla Bug).