Medium firefox Memory Corruption 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMemory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentNetworking
Bug ClassMemory Corruption
Tracker1950136
Fix commitffc5d04c816c (firefox) +12/-4
CISA KEVNot listed
Creditedthe Mozilla Fuzzing Team, Masayuki Nakano
Disclosed2025-05-27

Files Changed

  • netwerk/dns/PlatformDNSUnix.cpp
diff --git a/netwerk/dns/PlatformDNSUnix.cpp b/netwerk/dns/PlatformDNSUnix.cpp
index 0acf4d024a6..c104146a42e 100644
--- a/netwerk/dns/PlatformDNSUnix.cpp
+++ b/netwerk/dns/PlatformDNSUnix.cpp
@@ -9,6 +9,7 @@
 #include "mozilla/net/DNSPacket.h"
 #include "nsIDNSService.h"
 #include "mozilla/Maybe.h"
+#include "mozilla/Mutex.h"
 #include "mozilla/StaticPrefs_network.h"
 #include "mozilla/ThreadLocal.h"
 
@@ -22,6 +23,7 @@ namespace mozilla::net {
 
 #if defined(HAVE_RES_NINIT)
 MOZ_THREAD_LOCAL(struct __res_state*) sThreadRes;
+mozilla::StaticMutex sMutex MOZ_UNANNOTATED;
 #endif
 
 #define LOG(msg, ...) \
@@ -44,9 +46,12 @@ nsresult ResolveHTTPSRecordImpl(const nsACString& aHost,
   if (!sThreadRes.get()) {
     UniquePtr<struct __res_state> resState(new struct __res_state);
     memset(resState.get(), 0, sizeof(struct __res_state));
-    if (int ret = res_ninit(resState.get())) {
-      LOG("res_ninit failed: %d", ret);
-      return NS_ERROR_UNKNOWN_HOST;
+    {
+      StaticMutexAutoLock lock(sMutex);
+      if (int ret = res_ninit(resState.get())) {
+        LOG("res_ninit failed: %d", ret);
+        return NS_ERROR_UNKNOWN_HOST;
+      }
     }
     sThreadRes.set(resState.release());
   }
@@ -90,7 +95,10 @@ void DNSThreadShutdown() {
   }
 
   sThreadRes.set(nullptr);
-  res_nclose(res);
+  {
+    StaticMutexAutoLock lock(sMutex);
+    res_nclose(res);
+  }
   free(res);
 #endif
 }
Loading diff…