CVE-2024-6609: Mozilla Firefox Use-After-Free Vulnerability

CVE-2024-6609 Overview

CVE-2024-6609 is a memory safety vulnerability affecting Mozilla Firefox and Thunderbird versions prior to 128. Under near out-of-memory conditions, an elliptic curve key that was never allocated could be freed again, resulting in a double free condition. The flaw resides in the cryptographic code path that handles elliptic curve key material. An attacker who can trigger memory pressure in the target browser and serve crafted content may corrupt heap state and influence process control flow.

Critical Impact

A successful exploit can lead to memory corruption in the browser process, with potential for code execution, integrity loss, and denial of service across affected Firefox and Thunderbird installations.

Affected Products

• Mozilla Firefox versions prior to 128
• Mozilla Thunderbird versions prior to 128
• Debian LTS distributions packaging affected Firefox/Thunderbird builds

Discovery Timeline

• 2024-07-09 - CVE-2024-6609 published to the National Vulnerability Database
• 2024-07-09 - Mozilla publishes advisories MFSA-2024-29 and MFSA-2024-32
• 2024-10 - Debian LTS announcement released for affected packages
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-6609

Vulnerability Analysis

The vulnerability is a double free condition [CWE-415-class behavior, classified by NVD as NVD-CWE-noinfo] in the elliptic curve cryptography path used by Firefox and Thunderbird. When memory allocation for an elliptic curve key fails because the process is near out-of-memory, the code path treats the never-allocated key pointer as if it were valid and later passes it to a free routine. Freeing a pointer that was never allocated, or freeing a stale pointer twice, corrupts the underlying heap metadata.

Exploitation requires user interaction, such as visiting a malicious page or opening attacker-controlled HTML content in Thunderbird. The condition is reachable remotely over the network without privileges. Browser exploit chains commonly pair heap corruption primitives like this one with information disclosure to bypass ASLR.

Root Cause

The root cause is improper error handling in the elliptic curve key allocation logic. The code does not correctly distinguish between a successfully allocated key object and an allocation that returned a null or partial result. As a result, cleanup routines invoke free on a pointer that was never paired with a successful allocation, producing the double free.

Attack Vector

The attack vector is network-based. An attacker hosts a crafted page or message that drives the renderer toward memory exhaustion while exercising the elliptic curve key path. The victim must load the page or open the message. No authentication is required. Once the double free executes, the attacker can attempt to groom the heap and steer subsequent allocations to achieve arbitrary read, write, or execution primitives inside the content process.

No public proof-of-concept or exploit code is currently listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. See the Mozilla Bug Report #1839258 for additional technical context.

Detection Methods for CVE-2024-6609

Indicators of Compromise

• Unexpected Firefox or Thunderbird process crashes with heap corruption signatures, such as malloc_consolidate or tcache errors in core dumps
• Child content processes terminating with SIGABRT or Windows fast-fail exceptions shortly after rendering attacker-controlled content
• Browser telemetry showing repeated allocation failures in cryptographic modules under high memory pressure

Detection Strategies

• Inventory endpoints for Firefox and Thunderbird builds older than version 128 using software asset management or EDR telemetry
• Hunt for child process crashes spawned by firefox.exe or thunderbird.exe correlated with browsing activity to untrusted domains
• Inspect web proxy logs for high-entropy or repeatedly reloaded pages that may be attempting to induce memory exhaustion in clients

Monitoring Recommendations

• Forward browser crash reports and Windows Error Reporting events to a centralized analytics pipeline for review
• Alert on anomalous spikes in browser process memory consumption preceding a crash event
• Track outbound connections from browser processes to newly registered or low-reputation domains following user-initiated navigation

How to Mitigate CVE-2024-6609

Immediate Actions Required

• Upgrade Mozilla Firefox to version 128 or later on all managed endpoints
• Upgrade Mozilla Thunderbird to version 128 or later, including the ESR channel where applicable
• Apply distribution-provided updates such as the Debian LTS package update for systems on long-term support branches
• Restart browser and mail client processes after patching to ensure the vulnerable code is unloaded from memory

Patch Information

Mozilla addressed the vulnerability in Firefox 128 and Thunderbird 128. The fixes are documented in Mozilla Security Advisory MFSA-2024-29 and Mozilla Security Advisory MFSA-2024-32. Administrators using enterprise deployment channels should validate that the installed build reports version 128 or higher.

Workarounds

• Restrict browsing of untrusted content on hosts running unpatched Firefox or Thunderbird builds until updates can be applied
• Disable rendering of remote content in Thunderbird messages to reduce the attack surface for crafted HTML email
• Enforce strict memory and process limits on shared or multi-tenant systems to reduce the likelihood of reaching the vulnerable near-OOM state

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version on Linux endpoints
thunderbird --version

# Debian/Ubuntu: apply available security updates
sudo apt-get update && sudo apt-get install --only-upgrade firefox-esr thunderbird