Lukas Bernhard

توجد ثغرة أمنية من نوع «الاستخدام بعد التحرير» (Use After Free) في برنامج تشغيل مساحة المستخدم لوحدة معالجة الرسومات (GPU) Bifrost من شركة Arm Ltd، وفي برنامج تشغيل مساحة المستخدم لوحدة معالجة الرسومات (GPU) Valhall من شركة Arm Ltd، وفي برنامج تشغيل مساحة المستخدم لهندسة وحدة معالجة الرسومات (GPU) من الجيل الخامس من شركة Arm Ltd. وهذا يسمح لعملية مستخدم غير متمتعة بامتيازات بتنفيذ عمليات معالجة وحدة معالجة الرسومات (GPU)، بما في ذلك عبر WebGL أو WebGPU، للوصول إلى الذاكرة التي تم تحريرها بالفعل.

تتعلق المشكلة بمعالجة محتوى ويب مصمم بشكل خبيث، مما قد يؤدي إلى تلف الذاكرة بسبب تجاوز سعة المخزن المؤقت في مكون Web Handler. وقد يتيح ذلك لمهاجم عن بُعد الوصول إلى معلومات سرية. تم حل المشكلة من خلال تحسين معالجة الذاكرة.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 127 Firefox ESR versions prior to 115.12 Thunderbird versions prior to 115.12 Description: The issue is related to a use-after-free condition that could occur during object transplant in JavaScript, potentially allowing a remote attacker to execute arbitrary code or cause a denial of service. This is due to the garbage collection mechanism being triggered at a specific time, leading to the use-after-free condition. Recommendations: For Firefox versions prior to 127, update to version 127 or later to resolve the issue. For Firefox ESR versions prior to 115.12, update to version 115.12 or later to resolve the issue. For Thunderbird versions prior to 115.12, update to version 115.12 or later to resolve the issue.

The issue is related to a use-after-free in the JavaScript engine, allowing an attacker to read memory in the JavaScript string section of the heap. This could enable a remote attacker to access confidential data.

The issue is related to a missing iterator stop condition when handling WASM code in the built-in profiler. This could lead to invalid memory access and undefined behavior, potentially allowing an attacker to access confidential data, compromise its integrity, and cause a denial of service. The issue only affects the application when the profiler is running.

The issue is related to a buffer overflow in the js::CheckTracedThing() function of the Mozilla Firefox JIT compiler. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is caused by the possibility of mutating a JavaScript object in such a way that it crashes the JIT while tracing it.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 125 Description: The issue is related to the JIT component of the Mozilla Firefox browser, which incorrectly optimizes MSubstr operations, leading to out-of-bounds reads. This can allow a remote attacker to disclose protected information. Recommendations: For versions prior to 125, update to version 125 or later to resolve the issue. As a temporary workaround, consider disabling the JIT compiler until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

The issue is related to the JIT compiler incorrectly optimizing switch statements, resulting in out-of-bounds reads. This can potentially allow a remote attacker to disclose protected information.

The issue is related to the Garbage Collector component of Mozilla Firefox, Firefox ESR, and the Thunderbird email client, involving the use of memory after it has been freed. This can lead to potential use-after-free crashes during garbage collection, allowing a remote attacker to execute arbitrary code. The problem arises from the JIT creating incorrect code for arguments in certain cases.

The issue is related to a dereferencing of an untrusted pointer, which could allow a remote attacker to execute arbitrary code. In certain circumstances, JIT compiled code could dereference a wild pointer value, leading to an exploitable crash.

The issue is related to a use-after-free condition that could occur during Ion compilation due to Garbage Collection, potentially allowing an attacker to write two NUL bytes and cause a crash. This could result in a denial of service.

The issue is related to the `UpdateRegExpStatics` function attempting to access `initialStringHeap`, which could have been garbage collected prior to entering the function, potentially leading to an exploitable crash. This could allow a remote attacker to execute arbitrary code.

The issue is related to improved memory handling and may lead to arbitrary code execution when processing web content. It is associated with access to a memory cell before the start of a buffer in WPE WebKit and WebKitGTK modules, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

The issue is related to a Garbage Collector compaction, where weak maps may have been accessed before they were correctly traced, resulting in memory corruption and a potentially exploitable crash. This can allow a remote attacker to execute arbitrary code or cause a denial of service. The vulnerability is associated with a buffer overflow in the memory during the tracing process.

The issue relates to a call to the `bind` function potentially resulting in the incorrect realm, which may create a vulnerability concerning JavaScript-implemented sandboxes such as SES.

The issue is related to incorrect management of code generation, potentially leading to a crash when invalidating JIT code while following an iterator. This could allow a remote attacker to cause a denial of service or possibly other impacts.

The issue is related to the implementation of AudioWorklets, where some code may have casted one type to another, invalid, dynamic type, potentially leading to a crash. This could be exploited by a remote attacker to cause a denial of service.

The issue is related to uncontrolled resource exhaustion. If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This could allow a remote attacker to cause a denial of service.

The issue is related to errors in type conversion, which could lead to undefined behavior due to an invalid downcast from `nsHTMLDocument` to `nsIContent`. This may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

The issue is related to an invalid downcast from `nsTextNode` to `SVGElement`, which could lead to undefined behavior. This may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.