CVE-2024-4774: 
NixOS vulnerability analysis and mitigation

CVE-2024-4774 is a vulnerability discovered in Firefox's ShmemCharMapHashEntry() code that was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members. The vulnerability affects Firefox versions prior to 126 and was disclosed on May 14, 2024 (Mozilla Security, NVD).

The vulnerability exists in the ShmemCharMapHashEntry class which contains a mozilla::fontlist::Pointer member that has a std::atomic. The issue arises because the class is declared with ALLOW_MEMMOVE = true, allowing nsHashtable to move it using memmove() instead of calling its move constructor/move assignment operator. Since std::atomic is not guaranteed to be trivially copyable according to the C++ Standard N4750, this operation results in undefined behavior (Mozilla Bugzilla). The vulnerability has been assigned a CVSS base score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L (Ubuntu CVE).

The impact of this vulnerability is considered low as the actual compilers used by Mozilla implement atomics as trivially copyable in practice. While the undefined behavior exists, it's unlikely to cause significant security issues in current implementations (Mozilla Bugzilla).

There are no known exploits of this vulnerability in the wild. The issue was primarily identified as a theoretical concern rather than a practical security threat, as noted by Mozilla security researchers (Mozilla Bugzilla).

The vulnerability has been fixed in Firefox version 126. Users are advised to upgrade to Firefox 126 or later to receive the fix. The fix involves modifying the ShmemCharMapHashEntry implementation to properly handle move semantics (Mozilla Security).