Time-of-check Time-of-use (TOCTOU) Race Condition in Mozilla Firefox and Firefox ESR - CVE-2022-22753

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU60372

Time-of-check Time-of-use (TOCTOU) Race Condition in Mozilla Firefox and Firefox ESR - CVE-2022-22753

Published: February 8, 2022


Vulnerability identifier: #VU60372
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-22753
CWE-ID: CWE-367
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in the Maintenance (Updater) Service. A local unprivileged user can grant Users write access to an arbitrary directory on the system and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability affects Windows installations only.


Affected software

Mozilla Firefox
Firefox ESR
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Workstation Extension
Mozilla Thunderbird
MozillaFirefox
MozillaFirefox-translations-common
MozillaFirefox-translations-other
MozillaFirefox-debuginfo
MozillaFirefox-devel
MozillaFirefox-debugsource
MozillaThunderbird-translations-other
MozillaThunderbird-translations-common
MozillaThunderbird-debugsource
MozillaThunderbird-debuginfo
MozillaThunderbird

How to mitigate CVE-2022-22753

Install updates from vendor's website.

Mozilla Firefox - update to 97.0
Firefox ESR - update to 91.6.0
Mozilla Thunderbird - update to 91.6.0
MozillaFirefox - addressed in versions 91.6.0-78.162.2, 91.6.0-112.89.1, 91.6.0-150.18.1, 91.6.0-152.15.1
MozillaFirefox-translations-common - addressed in versions 91.6.0-78.162.2, 91.6.0-112.89.1, 91.6.0-150.18.1, 91.6.0-152.15.1
MozillaFirefox-translations-other - addressed in versions 91.6.0-78.162.2, 91.6.0-150.18.1, 91.6.0-152.15.1
MozillaFirefox-debuginfo - addressed in versions 91.6.0-78.162.2, 91.6.0-112.89.1, 91.6.0-150.18.1, 91.6.0-152.15.1
MozillaFirefox-devel - addressed in versions 91.6.0-112.89.1, 91.6.0-150.18.1, 91.6.0-152.15.1
MozillaFirefox-debugsource - addressed in versions 91.6.0-112.89.1, 91.6.0-150.18.1, 91.6.0-152.15.1
MozillaThunderbird-translations-other - update to 91.6.1-8.54.1
MozillaThunderbird-translations-common - update to 91.6.1-8.54.1
MozillaThunderbird-debugsource - update to 91.6.1-8.54.1
MozillaThunderbird-debuginfo - update to 91.6.1-8.54.1
MozillaThunderbird - update to 91.6.1-8.54.1

External References

Related Security Bulletins