Use-after-free while when manipulating certificates in the trusted cache

Use-after-free while when manipulating certificates in the trusted cache

Announced

July 22, 2014

Reporter

Tyson Smith, Jesse Schwartzentruber

Impact

High

Products

Firefox, Firefox ESR, Thunderbird

Fixed in

• Firefox 31
• Firefox ESR 24.7
• Thunderbird 24.7
• Thunderbird 31

Description

Security researchers Tyson Smith and Jesse Schwartzentruber used the Address Sanitizer tool while fuzzing to discover a use-after-free error resulting in a crash. This is a result of a pair of NSSCertificate structures being added to a trust domain and then one of them is removed while they are still in use by the trusted cache. This crash is potentially exploitable.

This issue was addressed in the Network Security Services (NSS) library in version 3.16.2, shipping on affected platforms.

In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts.

References

• heap-use-after-free in libnss3.so!CERT_DestroyCertificate (CVE-2014-1544)