CVE-2021-22570

What it actually does

Null pointer dereference triggered during protobuf symbol parsing when a null character is present, causing an unchecked access to a file name pointer that is null during error message generation and resulting in a crash.

Why it matters to the business

Local denial-of-service condition that can interrupt Firefox ESR sessions on Debian 10 systems; low likelihood of remote exploitation or data compromise but still requires prompt patching given the age of the flaw.

How an attack unfolds

An attacker supplies a specially crafted protobuf symbol containing a null byte that is parsed incorrectly; the resulting error path dereferences a null file pointer, crashing the process. No remote vector or known threat actor campaigns are associated with this issue.

How to fix it

Upgrade firefox-esr on Debian 10 to version 102.11.0esr-1~deb10u1 or later. Apply the package update through standard Debian repositories and restart affected instances.

How to confirm the fix worked

Verify the installed firefox-esr package version is at or above 102.11.0esr-1~deb10u1 using dpkg or apt; confirm absence of the vulnerable code path via source review or crash reproduction tests with null-containing symbols.

Typical attack path

1. Obtain local access or ability to supply a malicious protobuf input to the affected process
2. Craft a symbol containing an embedded null character
3. Trigger symbol parsing and error message generation path
4. Trigger null pointer dereference resulting in application crash

How to detect it

Search system and application logs for Firefox ESR segmentation faults or abrupt process terminations around the time of protobuf-related operations; no specific remote indicators exist.

What your security team should do

• Prioritize patching Debian 10 firefox-esr installations to the fixed version within standard maintenance windows
• Monitor for application crashes in Firefox ESR processes that could indicate attempted exploitation
• Review dependency usage of protobuf parsing libraries across other products for similar issues