In August 2023, a critical vulnerability was revealed in Mozilla Firefox, Firefox ESR, and Thunderbird. Catalogued as CVE-2023-4577, this bug targets a specific edge case in how JavaScript’s regular expressions interact with the browser’s memory management. While the technical writeups can get overwhelming, in this post let’s break down what happened, how it can be triggered, and the significance for users and developers.

What’s the Problem? (Simple Explanation)

The root of this flaw lies with a JavaScript function called UpdateRegExpStatics. This function, as the name hints, updates internal data about regular expressions (RegExp) within Firefox’s JavaScript engine, SpiderMonkey.

Inside UpdateRegExpStatics, there’s an object called initialStringHeap. The function expects that the heap object is alive and in-use for updating stats after a RegExp operation. However, under certain circumstances, the garbage collector could free ("collect") initialStringHeap just before the function uses it. This is called a *use-after-free* bug—a type of memory access error notorious for allowing attackers to crash a program or, sometimes, take over your machine.

Put simply:
> *Firefox could crash or be hacked if malicious JavaScript tricks the browser into using an already-freed chunk of memory when handling regular expressions.*

Thunderbird versions before 115.2

If you’re running later versions, you’re safe. But if not—update, now.

Here’s a simplified take on what happens under the hood

// Pseudocode representation
void UpdateRegExpStatics(RegExpStatics* res) {
    // res->initialStringHeap might be freed before this line due to GC!
    auto* heap = res->initialStringHeap;

    // Use of heap could cause crash/exploit if already deleted
    DoImportantRegExpStuff(heap);
}

The pitfall? If JavaScript code can force a *garbage collection* (GC) event at the right moment, it can *free* initialStringHeap just before UpdateRegExpStatics tries to access it. The browser then ends up accessing memory it shouldn’t, opening the door to bugs and exploits.

How would Exploit Code look?

Here’s a harmless, conceptual example in JavaScript showing the GC timing problem (real-world attacks would be more sophisticated):

let leaky = /a/;

// Trick browser into updating RegExpStatics
function forceGC() {
    for (let i = ; i < 10000; i++) {
        new Array(50000);
    }
}
leaky[Symbol.match] = function() {
    forceGC(); // Try to trigger a GC when RegExp is being updated
    return false;
}
"hello".match(leaky); // This hits the vulnerable path

In practice, a clever attacker could use this timing bug to crash Firefox, possibly craft an exploit (like using the freed heap for malicious code execution), and potentially take control over your session or system.

Why Does This Matter?

Use-after-free vulnerabilities are among the most serious, especially in browsers. They’re a favorite among attackers because they can sometimes be chained with other bugs to execute arbitrary code. This means with the right series of steps, someone could run whatever program they wanted—like spyware or ransomware—on your computer.

Mozilla patched this issue promptly in the following releases

- Firefox 117 Release Notes
- Firefox ESR 115.2 Release Notes
- Thunderbird 115.2 Release Notes

- Mozilla Foundation Security Advisory 2023-35

https://www.mozilla.org/en-US/security/advisories/mfsa2023-35/
- CVE entry: https://nvd.nist.gov/vuln/detail/CVE-2023-4577
- Bugzilla entry (may include extra technical details): https://bugzilla.mozilla.org/show_bug.cgi?id=1841684

Conclusion

CVE-2023-4577 is a classic example of how subtle bugs in memory management can lead to severe vulnerabilities in everyday software like browsers and mail clients. The best defense is keeping your software updated and learning how these bugs work so you can recognize and patch similar hazards in your own code.

If you’re a developer, remember: Never assume memory you’re about to use hasn’t been collected elsewhere! And if you’re a user: Keep your updates automatic and install them as soon as they’re available.

Timeline

Published on: 09/11/2023 09:15:00 UTC
Last modified on: 09/13/2023 03:46:00 UTC