CVE-2024-11705: Mozilla Firefox DOS Vulnerability

CVE-2024-11705 Overview

CVE-2024-11705 is a Null Pointer Dereference vulnerability affecting Mozilla Firefox and Thunderbird. The NSC_DeriveKey function in Mozilla's Network Security Services (NSS) library incorrectly assumed that the phKey parameter would always be non-NULL. When NULL was passed to this parameter, a segmentation fault (SEGV) occurred, causing application crashes. This behavior directly conflicted with the PKCS#11 v3.0 specification, which explicitly allows phKey to be NULL for certain cryptographic mechanisms.

Critical Impact

Remote attackers can exploit this vulnerability via network-based attacks to cause denial of service conditions and potentially access sensitive information in affected Firefox and Thunderbird installations.

Affected Products

• Mozilla Firefox versions prior to 133
• Mozilla Thunderbird versions prior to 133

Discovery Timeline

• November 26, 2024 - CVE-2024-11705 published to NVD
• June 24, 2025 - Last updated in NVD database

Technical Details for CVE-2024-11705

Vulnerability Analysis

The vulnerability resides in the NSC_DeriveKey function within Mozilla's NSS cryptographic library. This function is responsible for deriving cryptographic keys using various PKCS#11 mechanisms. The implementation made an unsafe assumption that the phKey output parameter would always contain a valid pointer to store the derived key handle.

According to the PKCS#11 v3.0 specification, certain key derivation mechanisms permit a NULL phKey parameter for operations that don't produce a key object, or for validation purposes. When the Mozilla implementation encountered a NULL pointer, it attempted to dereference it without proper validation, resulting in a segmentation fault.

This NULL pointer dereference vulnerability can be triggered remotely through network-based attack vectors. An attacker could craft malicious content or requests that invoke the vulnerable key derivation function with a NULL parameter, causing the application to crash. The vulnerability impacts both confidentiality and availability, as the crash could potentially expose sensitive memory contents or disrupt critical browser and email operations.

Root Cause

The root cause is improper input validation in the NSC_DeriveKey function (CWE-476: NULL Pointer Dereference). The function failed to validate that the phKey parameter was non-NULL before attempting to write the derived key handle to that memory location. This oversight created a deviation from the PKCS#11 v3.0 specification requirements and introduced a exploitable crash condition.

Attack Vector

The attack vector for CVE-2024-11705 is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Crafting malicious web content or network requests that trigger cryptographic operations in the browser
2. Causing the NSC_DeriveKey function to be called with a NULL phKey parameter
3. The resulting segmentation fault crashes the application, potentially exposing memory contents or causing denial of service

The vulnerability can be exploited through malicious websites, crafted emails in Thunderbird, or any content that exercises the vulnerable PKCS#11 key derivation code path. Technical details and the specific bug report are available at the Mozilla Bug Report #1921768.

Detection Methods for CVE-2024-11705

Indicators of Compromise

• Unexpected Firefox or Thunderbird crashes with segmentation fault (SEGV) signals
• Core dumps or crash reports referencing NSC_DeriveKey or NSS library functions
• Repeated application crashes when processing specific web content or emails
• System logs indicating signal 11 (SIGSEGV) for Firefox or Thunderbird processes

Detection Strategies

• Monitor application crash logs for segmentation faults in Firefox and Thunderbird processes
• Deploy endpoint detection rules to identify abnormal process termination patterns
• Implement web proxy logging to identify requests that precede browser crashes
• Review crash reporting telemetry for NSS-related stack traces

Monitoring Recommendations

• Enable Mozilla Crash Reporter integration for centralized crash analysis
• Configure system-level monitoring for SIGSEGV signals in browser processes
• Deploy network traffic analysis to identify potential exploit delivery mechanisms
• Implement version inventory scanning to identify vulnerable Firefox/Thunderbird installations

How to Mitigate CVE-2024-11705

Immediate Actions Required

• Update Mozilla Firefox to version 133 or later immediately
• Update Mozilla Thunderbird to version 133 or later immediately
• Review deployment inventory to identify all affected installations across the organization
• Prioritize patching for systems handling sensitive data or critical operations

Patch Information

Mozilla has released security patches addressing this vulnerability. Detailed patch information is available in the official security advisories:

• Mozilla Security Advisory MFSA-2024-63 - Firefox 133 Security Update
• Mozilla Security Advisory MFSA-2024-67 - Thunderbird 133 Security Update

Organizations should deploy these updates through their standard software distribution mechanisms. Enterprise environments using Mozilla's ESR (Extended Support Release) channels should verify patch availability for their specific release track.

Workarounds

• No official workarounds are available; upgrading to patched versions is the only complete remediation
• Consider temporarily restricting access to untrusted websites until patches are deployed
• Implement application sandboxing or containerization to limit crash impact
• Deploy web filtering to block known malicious domains that may attempt exploitation

# Verify Firefox version (should be 133 or later)
firefox --version

# Verify Thunderbird version (should be 133 or later)
thunderbird --version

# For Linux systems, update via package manager
# Debian/Ubuntu:
sudo apt update && sudo apt upgrade firefox thunderbird

# RHEL/Fedora:
sudo dnf update firefox thunderbird