^{CVE-2017-5426:}Firefox and Thunderbird sandbox bypass vulnerability on Linux systems with seccomp-bpf filter

Overview

This vulnerability (CWE-732: Incorrect Permission Assignment for Critical Resource) affects the sandbox implementation in Mozilla Firefox and Thunderbird on Linux systems. The Gecko Media Plugin (GMP) sandbox is designed to isolate potentially dangerous media content processing from the rest of the system. However, when a seccomp-bpf filter is already running when the GMP sandbox initializes, the sandbox fails to be properly applied. As a result, media content that should be processed within the sandbox runs with reduced security protections, potentially allowing attackers to escape the intended sandbox restrictions and access system resources that should be protected. This issue is specific to Linux systems and does not affect other operating systems.

Remediation

Users and administrators should update to Firefox 52 or later, or Thunderbird 52 or later, which contain fixes for this vulnerability. Mozilla has addressed the issue by ensuring that the Gecko Media Plugin sandbox is properly applied even when a seccomp-bpf filter is already running. If immediate updating is not possible, consider implementing additional system-level security controls to mitigate potential exploitation, such as running the browser with reduced privileges or within a container. Organizations should also ensure they have proper monitoring and detection capabilities to identify potential exploitation attempts.

References

1. Mozilla Foundation Security Advisory (MFSA2017-05): https://www.mozilla.org/security/advisories/mfsa2017-05/
2. Mozilla Foundation Security Advisory (MFSA2017-09): https://www.mozilla.org/security/advisories/mfsa2017-09/
3. Mozilla Bugzilla - Bug 1257361: https://bugzilla.mozilla.org/show_bug.cgi?id=1257361
4. SecurityFocus BID: 96694 - http://www.securityfocus.com/bid/96694
5. SecurityTracker ID: 1037966 - http://www.securitytracker.com/id/1037966