CVE-2023-5174

What it actually does

The vulnerability is a use-after-free caused by inadvertently double-freeing a pointer in the sandbox code when Windows fails to duplicate a handle during process creation.

Why it matters to the business

In non-standard Windows configurations such as runas, this flaw could allow remote code execution or crashes in Firefox and Thunderbird, potentially leading to system compromise; standard usage and other operating systems are unaffected.

How an attack unfolds

An attacker would need to induce a handle duplication failure during process creation in a non-standard Windows configuration to trigger the double-free and subsequent use-after-free for potential code execution.

How to fix it

Upgrade Firefox to 118 or later, Firefox ESR to 115.3 or later, and Thunderbird to 115.3 or later; avoid non-standard configurations such as runas on Windows.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed in the advisory and verify the application runs only in standard configurations on Windows.

Typical attack path

1. Identify target using Firefox or Thunderbird on Windows in a non-standard configuration such as runas
2. Trigger process creation that causes handle duplication to fail
3. Exploit the resulting use-after-free condition to achieve code execution or crash

How to detect it

Examine Windows event logs and browser crash reports for sandbox process creation failures involving handle duplication errors.

What your security team should do

• Apply the listed version upgrades across all affected Mozilla products
• Restrict use of non-standard Windows process creation methods
• Review browser crash reports for sandbox-related handle errors