CVE-2023-29532 Race condition in Firefox
A local attacker can exploit a race condition in the Mozilla Maintenance Service on Windows to apply unsigned updates, leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-29532?
CVE-2023-29532 is a medium-severity vulnerability in Mozilla Firefox, published on 19 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server.
*Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
Which versions are affected by CVE-2023-29532?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.
How do I fix CVE-2023-29532?
Upgrade to a fixed version.
Is CVE-2023-29532 being exploited?
There is no known exploitation of CVE-2023-29532 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-f2q9-pfpx-m83g, OESA-2024-1747, UBUNTU-CVE-2023-29532.