CVE-2022-22753 Race condition in Firefox
A race condition in the Firefox updater allows attackers to gain write access to arbitrary directories, potentially escalating privileges to SYSTEM.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-22753?
CVE-2022-22753 is a high-severity vulnerability in Mozilla Firefox, published on 22 Dec 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Weakness: CWE-367
Which versions are affected by CVE-2022-22753?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.
How do I fix CVE-2022-22753?
Upgrade to a fixed version.
Is CVE-2022-22753 being exploited?
There is no known exploitation of CVE-2022-22753 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-pr6h-wqwg-8wxx.