CVE-2022-38476

What it actually does

Data race in PK11_ChangePW leads to use-after-free, potentially allowing memory corruption and arbitrary code execution when a user changes their master password.

Why it matters to the business

Attackers could gain control of affected user systems running older Mozilla Firefox ESR or Thunderbird, risking theft of browsing data, email, or credentials; low urgency due to high complexity, stable low exploit probability, and publication over three years ago with no known campaigns.

How an attack unfolds

An attacker crafts a scenario to trigger concurrent access to the password change function, exploiting the missing lock to trigger the use-after-free for memory corruption and code execution, though high attack complexity and user interaction requirements make reliable exploitation difficult.

How to fix it

Upgrade Firefox ESR to version 102.2 or later and Thunderbird to version 102.2 or later; apply updates as soon as possible across all instances.

How to confirm the fix worked

Verify installed versions are at or above 102.2 for both products; review update logs and application about dialogs to confirm patches are applied.

Typical attack path

1. Identify a victim using an unpatched version of Firefox ESR or Thunderbird
2. Lure the user into performing a master password change while malicious content is active
3. Trigger the data race condition in PK11_ChangePW to induce use-after-free
4. Leverage memory corruption to execute attacker-controlled code

How to detect it

Examine browser process crash reports and memory dumps for signs of corruption around password change operations; review application logs for unusual concurrent access patterns, though no public indicators exist due to lack of known exploitation.

What your security team should do

• Prioritize updating all Firefox ESR and Thunderbird installations to 102.2 or newer
• Monitor for any new exploit maturity indicators despite current low EPSS and absence from KEV
• Review password management policies to reduce reliance on master password changes in older deployments