CVE-2022-31740

What it actually does

On arm64 architectures, WebAssembly code generation produced incorrect assembly that caused register allocation errors, resulting in memory corruption and a potentially exploitable crash.

Why it matters to the business

Attackers could achieve remote code execution or denial of service against users on affected arm64 systems running Firefox, Firefox ESR, or Thunderbird, exposing sensitive data and disrupting operations for organizations with arm64 endpoints or users.

How an attack unfolds

An attacker hosts a malicious webpage or email containing specially crafted WebAssembly that triggers the register allocation flaw when executed on arm64 devices; successful exploitation leads to memory corruption that can be leveraged for arbitrary code execution.

How to fix it

Upgrade Mozilla Firefox to version 101 or later, Firefox ESR to 91.10 or later, and Thunderbird to 91.10 or later. Apply updates through the built-in updater or package manager as soon as possible.

How to confirm the fix worked

Verify installed versions match or exceed Firefox 101, Firefox ESR 91.10, or Thunderbird 91.10; confirm absence of the vulnerable code paths by reviewing release notes or running the application on arm64 hardware with WebAssembly workloads.

Typical attack path

1. Attacker prepares malicious WebAssembly payload targeting the arm64 code-generation flaw
2. Victim is directed to a controlled webpage or receives a malicious email attachment
3. Browser or Thunderbird renders the content and executes the WebAssembly on an arm64 system
4. Incorrect register allocation triggers memory corruption
5. Attacker chains the corruption to achieve code execution or crash the process

How to detect it

Review application crash logs on arm64 systems for WebAssembly-related faults; correlate with browser history or email access around the time of any unexpected crashes.

What your security team should do

• Prioritize immediate updates for all arm64 endpoints running the affected Mozilla products
• Enforce automatic updates via enterprise policy where possible
• Monitor for any post-update stability issues with WebAssembly content
• Educate users on prompt installation of browser and email-client updates