Use-after-free during processing of DER encoded keys in NSS

Use-after-free during processing of DER encoded keys in NSS

Announced

March 8, 2016

Reporter

Tim Taubert

Impact

High

Products

Firefox, Firefox ESR, NSS, Thunderbird

Fixed in

• Firefox 45
• Firefox ESR 38.8
• NSS 3.19.2.4
• NSS 3.21.1
• Thunderbird 38.8
• Thunderbird 45

Description

Mozilla developer Tim Taubert used the Address Sanitizer tool and software fuzzing to discover a use-after-free vulnerability while processing DER encoded keys in the Network Security Services (NSS) libraries. The vulnerability overwrites the freed memory with zeroes. This issue has been addressed in NSS 3.21.1, shipping in Firefox 45.

References

• use-after-poison in PK11_ImportDERPrivateKeyInfoAndReturnKey() (CVE-2016-1979)