CVE-2024-1552: Mozilla Firefox Code Generation Vulnerability

CVE-2024-1552 Overview

CVE-2024-1552 is a code generation flaw in Mozilla Firefox, Firefox ESR, and Thunderbird that affects 32-bit ARM devices. The just-in-time (JIT) compiler produces incorrect code that can result in unexpected numeric conversions and potential undefined behavior. The flaw is classified under [CWE-681]: Incorrect Conversion between Numeric Types. It impacts Firefox versions prior to 123, Firefox ESR versions prior to 115.8, and Thunderbird versions prior to 115.8. Linux distributions including Debian also shipped affected packages.

Critical Impact
A remote attacker can serve crafted web content to a 32-bit ARM device running a vulnerable Firefox or Thunderbird build, triggering numeric conversion errors that undermine integrity guarantees in the browser.

Affected Products

Mozilla Firefox versions prior to 123 on 32-bit ARM
Mozilla Firefox ESR versions prior to 115.8 on 32-bit ARM
Mozilla Thunderbird versions prior to 115.8 on 32-bit ARM
Debian Linux 10.0 packages shipping affected Mozilla builds

Discovery Timeline

2024-02-20 - CVE-2024-1552 published to the National Vulnerability Database (NVD)
2025-03-27 - Last updated in NVD database

Technical Details for CVE-2024-1552

Vulnerability Analysis

The vulnerability resides in the Firefox JavaScript engine code generator on 32-bit ARM. The compiler emits incorrect machine code paths for certain numeric operations. As a result, conversions between numeric types do not match the expected semantics defined by the runtime. This mismatch can produce values that violate assumptions made by downstream code. The defect is restricted to the 32-bit ARM backend and does not affect x86, x86_64, or 64-bit ARM builds.

Root Cause

The defect is an incorrect conversion between numeric types ([CWE-681]) inside the JIT code generator. When the compiler lowers higher-level numeric operations to ARM32 instructions, the emitted sequence does not preserve the correct width, sign, or precision of the value. Downstream operations therefore consume a value that differs from what the JavaScript specification requires, leading to undefined behavior in the surrounding code paths.

Attack Vector

Exploitation requires the victim to visit attacker-controlled web content with a vulnerable 32-bit ARM build of Firefox or Thunderbird. No authentication and no user interaction beyond loading content are required. JavaScript executed inside the renderer is sufficient to reach the affected code generation paths. The integrity impact is high while confidentiality and availability are unaffected per the CVSS vector. Refer to the Mozilla Bug Report #1874502 and Mozilla Security Advisory MFSA-2024-05 for vendor analysis.

No verified public proof-of-concept code is available for this issue. The vulnerability mechanism is described in prose only; consult vendor advisories for low-level technical details.

Detection Methods for CVE-2024-1552

Indicators of Compromise

No public indicators of compromise are documented for CVE-2024-1552, and no exploitation in the wild has been reported.
Presence of Firefox builds older than 123, Firefox ESR older than 115.8, or Thunderbird older than 115.8 on 32-bit ARM endpoints is the primary risk signal.

Detection Strategies

Inventory all 32-bit ARM endpoints and query installed Firefox, Firefox ESR, and Thunderbird versions through endpoint management tooling.
Correlate package manager logs on Debian-based ARM systems against fixed package versions referenced in the Debian LTS Announcement.
Monitor browser crash telemetry on ARM32 devices for repeated faults inside JIT-emitted code regions.

Monitoring Recommendations

Track outbound web traffic from ARM32 fleets and alert on connections to newly registered or low-reputation domains delivering JavaScript-heavy content.
Enable browser update telemetry to confirm that all managed ARM32 devices have applied Mozilla's February 2024 security releases.
Review Thunderbird configuration to ensure remote content in messages is disabled until patches are deployed.

How to Mitigate CVE-2024-1552

Immediate Actions Required

Upgrade Firefox to version 123 or later on all 32-bit ARM devices.
Upgrade Firefox ESR to version 115.8 or later on all 32-bit ARM devices.
Upgrade Thunderbird to version 115.8 or later on all 32-bit ARM devices.
Apply Debian security updates for firefox-esr and thunderbird on ARM32 Debian systems per the published Debian LTS announcements.

Patch Information

Mozilla addressed CVE-2024-1552 in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Vendor advisories are published as MFSA-2024-05, MFSA-2024-06, and MFSA-2024-07. Debian shipped corresponding fixes through the Debian LTS Announcement #00000 and Debian LTS Announcement #00001. Devices on 64-bit architectures are not affected.

Workarounds

Restrict 32-bit ARM devices to trusted internal web applications until patches are applied.
Disable JavaScript on untrusted sites using browser policy controls where operationally feasible.
Disable automatic loading of remote content in Thunderbird to reduce exposure when reading messages.

bash

# Debian: update affected Mozilla packages on 32-bit ARM
sudo apt-get update
sudo apt-get install --only-upgrade firefox-esr thunderbird

# Verify installed versions meet the fixed baseline
firefox-esr --version    # expect 115.8 or later
thunderbird --version    # expect 115.8 or later