Use-after-free in DTLS during WebRTC session shutdown

Use-after-free in DTLS during WebRTC session shutdown

Announced

August 2, 2016

Reporter

Looben Yang

Impact

Critical

Products

Firefox, Firefox ESR

Fixed in

• Firefox 48
• Firefox ESR 45.3

Description

Security researcher Looben Yang reported a use-after-free vulnerability in WebRTC. This occurs during WebRTC session shutdown when DTLS objects in memory are freed while still actively in use. This results in a potentially exploitable crash.

References

• WebRTC - Use After Free in socket thread (CVE-2016-5258)