High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the IPC component
ComponentDOM
Bug ClassUAF
Tracker1924125
Fix commit83a675a5416e (firefox) +20/-6
CISA KEVNot listed
CreditedRandell Jesup
Disclosed2026-01-13

Files Changed

  • docshell/base/ChildProcessChannelListener.h
  • dom/webtransport/parent/WebTransportParent.h
  • toolkit/components/glean/bindings/private/Ping.cpp
  • xpcom/ds/nsTHashtable.h
diff --git a/docshell/base/ChildProcessChannelListener.h b/docshell/base/ChildProcessChannelListener.h
index c00c2ff5a72..30bdc8c7223 100644
--- a/docshell/base/ChildProcessChannelListener.h
+++ b/docshell/base/ChildProcessChannelListener.h
@@ -45,8 +45,8 @@ class ChildProcessChannelListener final {
   };
 
   // TODO Backtrack.
-  nsTHashMap<nsUint64HashKey, Callback> mCallbacks;
-  nsTHashMap<nsUint64HashKey, CallbackArgs> mChannelArgs;
+  nsTHashMap<NoMemMoveKey<nsUint64HashKey>, Callback> mCallbacks;
+  nsTHashMap<NoMemMoveKey<nsUint64HashKey>, CallbackArgs> mChannelArgs;
 };
 
 }  // namespace mozilla::dom
diff --git a/dom/webtransport/parent/WebTransportParent.h b/dom/webtransport/parent/WebTransportParent.h
index 89b575f5b9d..fc5f30a8b60 100644
--- a/dom/webtransport/parent/WebTransportParent.h
+++ b/dom/webtransport/parent/WebTransportParent.h
@@ -103,9 +103,11 @@ class WebTransportParent : public PWebTransportParent,
     OnResetOrStopSendingCallback mCallback;
     nsCOMPtr<T> mStream;
   };
-  nsTHashMap<nsUint64HashKey, StreamHash<nsIWebTransportBidirectionalStream>>
+  nsTHashMap<NoMemMoveKey<nsUint64HashKey>,
+             StreamHash<nsIWebTransportBidirectionalStream>>
       mBidiStreamCallbackMap;
-  nsTHashMap<nsUint64HashKey, StreamHash<nsIWebTransportSendStream>>
+  nsTHashMap<NoMemMoveKey<nsUint64HashKey>,
+             StreamHash<nsIWebTransportSendStream>>
       mUniStreamCallbackMap;
 };
 
diff --git a/toolkit/components/glean/bindings/private/Ping.cpp b/toolkit/components/glean/bindings/private/Ping.cpp
index a2374944653..9bac6cbf955 100644
--- a/toolkit/components/glean/bindings/private/Ping.cpp
+++ b/toolkit/components/glean/bindings/private/Ping.cpp
@@ -23,7 +23,8 @@ namespace mozilla::glean {
 
 namespace impl {
 
-using CallbackMapType = nsTHashMap<uint32_t, FalliblePingTestCallback>;
+using CallbackMapType =
+    nsTHashMap<NoMemMoveKey<nsUint32HashKey>, FalliblePingTestCallback>;
 using MetricIdToCallbackMutex = StaticDataMutex<UniquePtr<CallbackMapType>>;
 static Maybe<MetricIdToCallbackMutex::AutoLock> GetCallbackMapLock() {
   static MetricIdToCallbackMutex sCallbacks("sCallbacks");
diff --git a/xpcom/ds/nsTHashtable.h b/xpcom/ds/nsTHashtable.h
index 8a557764b1a..51117b30547 100644
--- a/xpcom/ds/nsTHashtable.h
+++ b/xpcom/ds/nsTHashtable.h
@@ -650,6 +650,15 @@ static void FixedSizeEntryMover(PLDHashTable*, const PLDHashEntryHdr* aFrom,
   memcpy(aTo, aFrom, N);
 }
 
+// Helper type which wraps the access to EntryType::ALLOW_MEMMOVE. This is done
+// to ensure that the MOZ_NEEDS_MEMMOVABLE_TYPE attribute is applied to the
+// entry if we're going to use FixedSizeEntryMover, performing extra
+// compile-time checks against the use of non-memmoveable types.
+template <class EntryType, bool = EntryType::ALLOW_MEMMOVE>
+struct MOZ_NEEDS_MEMMOVABLE_TYPE CheckAllowMemmove : std::true_type {};
+template <class EntryType>
+struct CheckAllowMemmove<EntryType, false> : std::false_type {};
+
 }  // namespace detail
 }  // namespace mozilla
 
@@ -675,7 +684,9 @@ template <class EntryType>
   // function avoids that problem.
   static const PLDHashTableOps sOps = {
       s_HashKey, s_MatchEntry,
-      EntryType::ALLOW_MEMMOVE
+      // We intentionally indirect the access of ALLOW_MEMMOVE through
+      // CheckAllowMemmove to perform some additional static analysis.
+      mozilla::detail::CheckAllowMemmove<EntryType>::value
           ? mozilla::detail::FixedSizeEntryMover<sizeof(EntryType)>
           : s_CopyEntry,
       // Simplify hashtable clearing in case our entries are trivially
Loading diff…