CVE-2024-11704: Mozilla Firefox Use-After-Free Vulnerability

CVE-2024-11704 Overview

A double-free vulnerability exists in Mozilla Firefox and Thunderbird's cryptographic processing code, specifically within the sec_pkcs7_decoder_start_decrypt() function. When handling certain error paths during PKCS#7 decryption operations, the same symmetric key could be freed twice, potentially leading to memory corruption. This vulnerability could allow attackers to achieve arbitrary code execution or cause application crashes through crafted content.

Critical Impact

This double-free vulnerability in the PKCS#7 decryption handler could lead to memory corruption, potentially enabling remote code execution when processing malicious encrypted content in Firefox or Thunderbird.

Affected Products

• Mozilla Firefox versions prior to 133
• Mozilla Thunderbird versions prior to 133
• Mozilla Firefox ESR versions prior to 128.7
• Mozilla Thunderbird versions prior to 128.7

Discovery Timeline

• November 26, 2024 - CVE-2024-11704 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2024-11704

Vulnerability Analysis

This vulnerability is classified as CWE-415 (Double Free), a memory corruption vulnerability that occurs when memory is deallocated more than once. The flaw exists in the sec_pkcs7_decoder_start_decrypt() function, which is part of Mozilla's Network Security Services (NSS) library responsible for handling PKCS#7 cryptographic operations.

During the decryption initialization process, if an error condition is encountered, the error handling path incorrectly frees a symmetric key that may have already been freed or will be freed again during cleanup. This creates a double-free condition where the same memory location is released twice.

The vulnerability is network-exploitable and requires no user interaction or privileges to trigger, making it particularly dangerous. An attacker could craft malicious encrypted content (such as S/MIME emails in Thunderbird or encrypted web content in Firefox) that triggers the vulnerable error path during decryption.

Root Cause

The root cause is improper memory management in the error handling logic of the PKCS#7 decoder. When sec_pkcs7_decoder_start_decrypt() encounters an error condition, the symmetric key object is freed without properly tracking whether it has already been deallocated or will be deallocated by other cleanup routines. This results in the same memory being freed twice.

Double-free vulnerabilities can corrupt heap metadata, potentially allowing an attacker to control memory allocation and achieve arbitrary code execution. In the context of a browser or email client, this could lead to complete compromise of the application and potentially the underlying system.

Attack Vector

The vulnerability can be exploited remotely over the network. Potential attack scenarios include:

• Email-based attacks: Sending a maliciously crafted S/MIME encrypted email to a Thunderbird user that triggers the vulnerable code path during decryption
• Web-based attacks: Hosting malicious encrypted content on a website that triggers the vulnerability when accessed by Firefox
• Man-in-the-middle attacks: Intercepting and modifying encrypted traffic to inject content that exploits the vulnerability

The vulnerability resides in the PKCS#7 decryption initialization routine. When processing specially crafted encrypted content, the error handling path fails to properly manage the symmetric key's memory lifecycle. The double-free occurs when error cleanup attempts to deallocate a key that was already freed or will be freed by the normal cleanup path. Successful exploitation could corrupt heap structures and potentially allow attacker-controlled data to be written to arbitrary memory locations. For detailed technical analysis, refer to Mozilla Bug Report #1899402.

Detection Methods for CVE-2024-11704

Indicators of Compromise

• Unexpected crashes in Firefox or Thunderbird processes, particularly when processing encrypted content
• Crash reports referencing sec_pkcs7_decoder_start_decrypt() or related NSS cryptographic functions
• Anomalous memory access patterns in browser or email client processes
• Suspicious S/MIME encrypted emails from unknown senders

Detection Strategies

• Monitor for application crashes with memory corruption signatures in Firefox and Thunderbird
• Implement endpoint detection rules for unusual process behavior following encrypted content processing
• Deploy network-based detection for malformed PKCS#7 structures in email traffic
• Enable crash reporting analysis to identify patterns consistent with double-free exploitation attempts

Monitoring Recommendations

• Enable detailed crash reporting in Firefox and Thunderbird to capture memory corruption events
• Monitor system logs for repeated crashes of Mozilla applications
• Implement network monitoring for suspicious encrypted email attachments
• Use SentinelOne's behavioral AI to detect exploitation attempts targeting browser and email client processes

How to Mitigate CVE-2024-11704

Immediate Actions Required

• Update Mozilla Firefox to version 133 or later immediately
• Update Mozilla Firefox ESR to version 128.7 or later
• Update Mozilla Thunderbird to version 133 or 128.7 or later
• Review and apply security updates from Debian for affected packages if running Debian-based systems

Patch Information

Mozilla has released security patches addressing this vulnerability. Administrators should apply the following updates:

• Firefox: Upgrade to version 133 or later (MFSA-2024-63)
• Firefox ESR: Upgrade to version 128.7 or later (MFSA-2025-09)
• Thunderbird: Upgrade to version 133 or 128.7 or later (MFSA-2024-67, MFSA-2025-10)

Debian users should refer to the Debian LTS security announcements for package-specific updates.

Workarounds

• Disable automatic processing of encrypted email content in Thunderbird until patches can be applied
• Implement network-level filtering for S/MIME encrypted content from untrusted sources
• Consider using alternative browsers temporarily if immediate patching is not possible
• Enable enhanced security policies that restrict cryptographic content processing

# Verify Firefox version after update
firefox --version
# Expected output: Mozilla Firefox 133.x or later

# Verify Thunderbird version after update
thunderbird --version
# Expected output: Mozilla Thunderbird 133.x or 128.7+ for ESR