{"id":2464,"date":"2022-03-10T13:00:00","date_gmt":"2022-03-10T20:00:00","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/?p=2464"},"modified":"2022-03-10T12:38:16","modified_gmt":"2022-03-10T19:38:16","slug":"firefox-plugs-holes-in-their-sandbox","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/03\/10\/firefox-plugs-holes-in-their-sandbox\/","title":{"rendered":"Firefox Plugs Holes In Their Sandbox"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

On Tuesday of this week, Mozilla released a patch for Firefox that removed a pair of use-after-free bugs from the browsing software. These zero-day bugs allowed attackers to abuse thread shutdowns and text reflows to escape from the security sandbox and possibly launch RCE attacks on victims. There was also another bug that was patched that had allowed users to escape from the security sandbox using an iframe. This bug could then be used to launch an attack through the code that had previously been trapped in the sandbox but is now free to wreak havoc.<\/p>\n\n\n\n

What is Use-After-Free<\/h2>\n\n\n\n

So what exactly is a use-after-free bug? Well, a UAF occurs when a register within the heap memory of a program is emptied, but not set to null. When this happens, it allows a knowledgeable user to access that register and insert their own data into it. An attacker can then use this vulnerability to insert malicious code into an instance of the heap, allowing them to release said malicious code from the confines of the security sandbox. This would allow for an attacker to launch Remote-Code-Execution attacks, or RCE\u2019s for short, on the victim’s computers if they access the \u201cempty\u201d register during their browsing.<\/p>\n\n\n\n

What is the security sand box and why does it matter<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

At this point, I have also made several references to the security sandbox, so what is that? The security sandbox works similarly to a virtual machine, in that it emulates the environment of a host device while keeping all programs executed within the sandbox environment from escaping onto the user\u2019s primary system. With this in mind, we can simulate the threat that escaping the sandbox poses with an example. Imagine, for the sake of argument, that you filled a physical sandbox with bleach. That bleach is only able to attack whatever you put in the sandbox, but can\u2019t burn any of the grass laying just beyond the border. However, if you were to poke a hole in the side of the sandbox, then all that bleach would flow out and ruin your garden.<\/p>\n\n\n\n

Now, let\u2019s take our example and apply it to a computer, but instead of bleach, we have a malicious virus ready to eat away at our private data. The same problem occurs when a hole emerges, through the use of one of the UAFs or the iframe bug. Now, instead of a garden getting turned into no-man\u2019s-land by bleach, your computer has been infected with a virus. This is the risk that these bugs, which have thankfully been fixed, could cause.<\/p>\n\n\n\n

So What Now?<\/h2>\n\n\n\n

These three bugs mentioned already aren\u2019t the only sandbox breaking holes that Firefox has sealed up in recent history. Only this past Saturday, Firefox released another patch that fixed a different pair of UAFs that were even more dangerous than the two mentioned above. If it weren’t for the bounty hunters that found these bugs, or who are credited for bringing them to Mozilla’s attention, these bugs could have caused a lot of serious issues for the general public. How swiftly Mozilla worked to patch these bugs once they were brought to their attention just goes to show that cyber security is higly prioritised. Their team is working hard to bring its users a safe environment to use for scrolling about the near-infinite realm known as the internet.<\/p>\n\n\n\n

Resources:<\/h2>\n\n\n\n

https:\/\/www.firewall<\/a>s.com\/blog\/security-terms\/use-free-uaf\/#:~:text=Use%20After%20Free%20(UAF)%20refers,been%20assigned%20to%20another%20application<\/a>.<\/p>\n\n\n\n

https:\/\/encyclopedia.kaspersky.com\/glossary\/use-after-free\/<\/a><\/p>\n\n\n\n

https:\/\/threatpost.com\/firefox-zero-day-bugs-rce-sandbox-escape\/178779\/<\/a><\/p>\n\n\n\n

https:\/\/www.forcepoint.com\/cyber-edu\/sandbox-security<\/a><\/p>\n\n\n\n

https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2022-10\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

On Tuesday of this week, Mozilla released a patch for Firefox that removed a pair of use-after-free bugs from the browsing software. These zero-day bugs allowed attackers to abuse thread shutdowns and text reflows to escape from the security sandbox and possibly launch RCE attacks on victims. There was also another bug that was patched … <\/p>\n

Continue reading “Firefox Plugs Holes In Their Sandbox”<\/span><\/a><\/p>\n","protected":false},"author":409,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[15],"tags":[],"class_list":["post-2464","post","type-post","status-publish","format-standard","hentry","category-cpsc-329-602-w22","entry"],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Michael Kacmar","author_link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/author\/michael-kacmar\/"},"_links":{"self":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts\/2464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/users\/409"}],"replies":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/comments?post=2464"}],"version-history":[{"count":2,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts\/2464\/revisions"}],"predecessor-version":[{"id":2476,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts\/2464\/revisions\/2476"}],"wp:attachment":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/media?parent=2464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/categories?post=2464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/tags?post=2464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}