CVE-2022-28281

What it actually does

An out-of-bounds write occurs when a compromised content process sends an unexpected number of WebAuthN Extensions in a Register command to the parent process, resulting in memory corruption and a potentially exploitable crash.

Why it matters to the business

Attackers with access to a compromised content process could achieve remote code execution or cause application crashes, leading to system compromise, data exposure, or service disruption. Public exploit code increases urgency for organizations using affected versions.

How an attack unfolds

An attacker first compromises a content process, then sends a crafted Register command containing an unexpected number of WebAuthN Extensions. This triggers an out-of-bounds write in the parent process, enabling memory corruption that can be leveraged for further exploitation or denial of service.

How to fix it

Upgrade ikus060/rdiffweb to commit 233befc33bdc45d4838c773d5aed4408720504c5. For Mozilla products apply the corresponding updates: Thunderbird 91.8+, Firefox 99+, Firefox ESR 91.8+.

How to confirm the fix worked

Verify the installed version or commit hash matches the fixed release. Test WebAuthN registration flows to confirm absence of crashes under malformed extension counts.

Typical attack path

1. Compromise a content process
2. Craft and send Register command with excessive WebAuthN Extensions
3. Trigger out-of-bounds write in parent process
4. Exploit resulting memory corruption for code execution or crash

How to detect it

Inspect application logs for WebAuthN Register commands with anomalous extension counts or unexpected crashes during authentication flows. Correlate with process memory error events.

What your security team should do

• Prioritize patching affected instances within the next 48 hours given available public exploits
• Monitor for abnormal WebAuthN command patterns in logs
• Review and restrict content process privileges where feasible