CVE-2024-7531: Firefox Information Disclosure Vulnerability

CVE-2024-7531 Overview

CVE-2024-7531 is a cryptographic vulnerability in Mozilla's Network Security Services (NSS) library that affects the PK11_Encrypt() function when using the CKM_CHACHA20 cipher mechanism. When the same buffer is used for both input and output on Intel Sandy Bridge processors, the encryption operation can fail to properly encrypt data, potentially exposing plaintext. In the context of Firefox, this vulnerability specifically impacts the QUIC header protection feature when connections use the ChaCha20-Poly1305 cipher suite.

Critical Impact

Network observers may be able to correlate encrypted traffic across network path changes, potentially compromising user privacy and enabling traffic analysis attacks against affected Firefox users on Intel Sandy Bridge systems.

Affected Products

• Mozilla Firefox versions prior to 129
• Mozilla Firefox ESR versions prior to 115.14
• Mozilla Firefox ESR versions prior to 128.1

Discovery Timeline

• 2024-08-06 - CVE-2024-7531 published to NVD
• 2025-03-19 - Last updated in NVD database

Technical Details for CVE-2024-7531

Vulnerability Analysis

This vulnerability stems from a race condition (CWE-367: Time-of-Check Time-of-Use) in the NSS cryptographic library's implementation of ChaCha20 encryption. The issue specifically manifests when the PK11_Encrypt() function is called with the CKM_CHACHA20 mechanism and the same memory buffer is provided for both the plaintext input and ciphertext output—a common optimization pattern known as "in-place encryption."

On Intel Sandy Bridge processors, this in-place encryption pattern triggers a timing-sensitive condition where the encryption may not properly transform the data, leaving portions of plaintext exposed. The vulnerability affects Firefox's QUIC protocol implementation, specifically the header protection mechanism that relies on ChaCha20-Poly1305 for securing connection metadata.

The practical impact includes connection instability due to high packet loss when the encryption fails, as well as potential privacy implications. If a connection persists despite the packet loss, a network observer could potentially identify that packets originating from different network paths belong to the same session—undermining QUIC's connection migration privacy guarantees.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition in the NSS library's ChaCha20 implementation. When using in-place encryption with the same buffer for input and output, the processor's memory operations on Intel Sandy Bridge architecture can create a race between reading the plaintext and writing the ciphertext. This results in incomplete or failed encryption operations, leaving data unprotected during transit.

Attack Vector

The attack vector is network-based and requires no authentication or special privileges from the attacker. However, successful exploitation requires specific conditions to be met:

1. The target must be running an affected Firefox version on a system with an Intel Sandy Bridge processor
2. The connection must use the ChaCha20-Poly1305 cipher suite for QUIC
3. The attacker must have the ability to observe network traffic (passive network position)

The vulnerability exposes encrypted data through failed encryption operations, allowing network observers to potentially correlate traffic patterns and identify connection migrations. While user interaction is required (the user must initiate a browsing session), the actual exploitation is passive and requires no direct interaction with the target system.

The vulnerability primarily affects confidentiality rather than integrity or availability, as the exposed plaintext relates to QUIC header protection data that can be used for traffic analysis.

Detection Methods for CVE-2024-7531

Indicators of Compromise

• Unusual connection failures or high packet loss rates in Firefox when using QUIC connections
• Presence of Intel Sandy Bridge processors (2nd generation Core i3/i5/i7) in the environment running vulnerable Firefox versions
• Network traffic showing inconsistent encryption patterns in QUIC header protection fields

Detection Strategies

• Monitor browser version inventory to identify Firefox installations below version 129, ESR below 115.14, or ESR 128.x below 128.1
• Implement network monitoring for QUIC protocol anomalies that may indicate encryption failures
• Audit system hardware profiles to identify Intel Sandy Bridge processors that may be susceptible to this condition

Monitoring Recommendations

• Enable browser auto-update features and monitor update compliance across the organization
• Implement endpoint detection rules to flag vulnerable Firefox versions in your software inventory
• Review network logs for unusual patterns in QUIC connection behavior

How to Mitigate CVE-2024-7531

Immediate Actions Required

• Update Mozilla Firefox to version 129 or later immediately
• Update Mozilla Firefox ESR to version 115.14 or later, or version 128.1 or later
• Prioritize updates for systems running Intel Sandy Bridge processors
• Consider temporarily disabling QUIC protocol in Firefox on vulnerable systems until updates can be applied

Patch Information

Mozilla has released security patches addressing this vulnerability in Firefox 129, Firefox ESR 115.14, and Firefox ESR 128.1. Detailed patch information is available in the official security advisories:

• Mozilla Security Advisory MFSA-2024-33
• Mozilla Security Advisory MFSA-2024-34
• Mozilla Security Advisory MFSA-2024-35

Technical details about the underlying bug can be found in Mozilla Bug Report #1905691.

Workarounds

• Disable QUIC protocol in Firefox by navigating to about:config and setting network.http.http3.enable to false
• Configure connections to use alternative cipher suites that do not rely on ChaCha20-Poly1305
• Consider using alternative browsers on Intel Sandy Bridge systems until patches are applied

# Firefox QUIC Disable Configuration
# Navigate to about:config in Firefox and set:
# network.http.http3.enable = false
# This disables QUIC/HTTP3 and forces fallback to HTTP/2 over TLS