CVE-2021-29986
📋 TL;DR
A race condition in the getaddrinfo function in Mozilla Thunderbird and Firefox on Linux systems could cause memory corruption and lead to a potentially exploitable crash. This vulnerability could allow attackers to execute arbitrary code or cause denial of service. It affects Thunderbird versions before 78.13 and 91, and Firefox ESR before 78.13 and Firefox before 91.
💻 Affected Systems
- Mozilla Thunderbird
- Mozilla Firefox
- Mozilla Firefox ESR
📦 What is this software?
Firefox by Mozilla
Firefox Esr by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or installation of persistent malware.
Likely Case
Application crash causing denial of service, potentially leading to data loss or disruption of email/browsing services.
If Mitigated
Limited impact with proper network segmentation and application sandboxing, potentially just application restart required.
🎯 Exploit Status
Race conditions are difficult to exploit reliably, requiring precise timing. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Thunderbird 78.13, Thunderbird 91, Firefox ESR 78.13, Firefox 91
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2021-33/
Restart Required: Yes
Instructions:
1. Update Thunderbird to version 78.13 or 91+ via built-in updater or package manager. 2. Update Firefox to version 91+ or Firefox ESR to 78.13+ via built-in updater or package manager. 3. Restart the application after update.
🔧 Temporary Workarounds
Disable automatic DNS resolution
linuxConfigure applications to use static DNS entries or disable certain network features that trigger getaddrinfo calls.
Network filtering
allUse firewall rules to restrict network access to Thunderbird/Firefox instances, limiting exposure to malicious DNS responses.
🧯 If You Can't Patch
- Restrict network access to vulnerable applications using host-based firewalls or network segmentation.
- Monitor for abnormal application crashes or memory usage patterns that might indicate exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check application version in Thunderbird: Help > About Thunderbird; in Firefox: Help > About Firefox. Verify version is below patched versions.Check Version:
thunderbird --version; firefox --versionVerify Fix Applied:
Confirm application version matches or exceeds Thunderbird 78.13/91, Firefox 91, or Firefox ESR 78.13.📡 Detection & Monitoring
Log Indicators:
- Application crash logs with segmentation fault or memory corruption errors
- Unusual process termination of Thunderbird/Firefox
Network Indicators:
- Suspicious DNS queries preceding application crashes
- Unusual network traffic patterns to/from Thunderbird/Firefox instances
SIEM Query:
source="application_logs" AND (process="thunderbird" OR process="firefox") AND (event="crash" OR event="segmentation fault")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1696138
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1696138
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-33/
- https://www.mozilla.org/security/advisories/mfsa2021-34/
- https://www.mozilla.org/security/advisories/mfsa2021-35/
- https://www.mozilla.org/security/advisories/mfsa2021-36/
