CVE-2024-6613
📋 TL;DR
This vulnerability in Firefox and Thunderbird involves a WebAssembly (wasm) frame iterator getting stuck in an infinite loop when processing certain wasm frames, leading to incorrect stack traces. This affects Firefox versions before 128 and Thunderbird versions before 128. The issue could cause denial of service or potentially be leveraged for other attacks.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
An attacker could craft malicious wasm content to trigger the infinite loop, causing the browser or email client to hang or crash, leading to denial of service. In combination with other vulnerabilities, it might enable arbitrary code execution.
Likely Case
Most probable impact is denial of service where the application becomes unresponsive or crashes when processing specially crafted wasm content.
If Mitigated
With proper controls like updated versions, the vulnerability is eliminated. Network filtering could block malicious wasm content before it reaches the application.
🎯 Exploit Status
Exploitation requires delivering malicious wasm content to the vulnerable application, which could be done via web pages or email attachments.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 128, Thunderbird 128
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-29/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update to version 128 or higher. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable WebAssembly
allDisable WebAssembly execution in Firefox/Thunderbird to prevent exploitation
In Firefox/Thunderbird address bar, type 'about:config', search for 'javascript.options.wasm', set to false
Use Content Security Policy
allImplement CSP to restrict wasm content loading
Add 'script-src' directive with appropriate restrictions in web server configuration
🧯 If You Can't Patch
- Disable WebAssembly via about:config settings
- Use network filtering to block wasm content from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Firefox/Thunderbird version: if version is less than 128, the system is vulnerable.Check Version:
firefox --version (Linux) or check About Firefox in applicationVerify Fix Applied:
After updating, verify version is 128 or higher and test with known safe wasm content.📡 Detection & Monitoring
Log Indicators:
- Application crash logs
- High CPU usage spikes
- Process hanging indicators
Network Indicators:
- Unusual wasm file downloads
- Suspicious web content delivery
SIEM Query:
source="firefox.log" AND ("crash" OR "hang" OR "high cpu")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1900523
- https://www.mozilla.org/security/advisories/mfsa2024-29/
- https://www.mozilla.org/security/advisories/mfsa2024-32/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1900523
- https://www.mozilla.org/security/advisories/mfsa2024-29/
- https://www.mozilla.org/security/advisories/mfsa2024-32/
