CVE-2024-8384: Mozilla Firefox Use-After-Free Vulnerability

CVE-2024-8384 Overview

CVE-2024-8384 is a memory corruption vulnerability affecting Mozilla Firefox and Firefox ESR browsers. The JavaScript garbage collector could mis-color cross-compartment objects if Out-of-Memory (OOM) conditions were detected at the right point between two passes. This flaw could lead to memory corruption, potentially enabling attackers to execute arbitrary code or cause denial of service conditions through specially crafted web content.

Critical Impact

This vulnerability allows remote attackers to potentially achieve arbitrary code execution by triggering memory corruption through carefully timed OOM conditions in the JavaScript garbage collector. No user interaction beyond visiting a malicious webpage is required.

Affected Products

• Mozilla Firefox versions prior to 130
• Mozilla Firefox ESR versions prior to 128.2
• Mozilla Firefox ESR versions prior to 115.15
• Mozilla Thunderbird versions prior to 128.2
• Mozilla Thunderbird versions prior to 115.15

Discovery Timeline

• September 3, 2024 - CVE-2024-8384 published to NVD
• November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2024-8384

Vulnerability Analysis

This vulnerability resides in the SpiderMonkey JavaScript engine's garbage collector implementation. The issue occurs during the mark-and-sweep garbage collection process, specifically when handling cross-compartment objects. Compartments in SpiderMonkey are used to isolate JavaScript objects from different origins or contexts, providing crucial security boundaries within the browser.

The garbage collector uses a tri-color marking scheme (white, gray, black) to track object reachability. When processing cross-compartment references, the collector must properly "color" objects to ensure they are not prematurely freed. However, if an OOM condition occurs at a specific point between two garbage collection passes, the coloring mechanism can fail, leading to objects being incorrectly marked.

This mis-coloring can result in use-after-free conditions (CWE-416) or out-of-bounds writes (CWE-787), as the garbage collector may free objects that are still in use or fail to properly track object boundaries.

Root Cause

The root cause lies in insufficient error handling during the garbage collection's marking phase when processing cross-compartment object references. When memory allocation fails due to OOM conditions at a critical point between two collection passes, the garbage collector does not properly maintain the invariants required for correct object coloring. This creates a race-like condition where the collector's internal state becomes inconsistent, leading to memory safety violations.

Attack Vector

An attacker can exploit this vulnerability by crafting malicious JavaScript that deliberately triggers OOM conditions while simultaneously creating cross-compartment object references. The attack vector is network-based, requiring no authentication or user privileges beyond convincing the target to visit a malicious webpage or load untrusted JavaScript content.

The exploitation would typically involve:

1. Creating numerous cross-compartment object references through iframe manipulation or worker threads
2. Triggering memory pressure to induce OOM conditions
3. Timing the memory pressure to coincide with garbage collection passes
4. Leveraging the resulting memory corruption for further exploitation

Due to the complexity of precisely timing OOM conditions with garbage collection cycles, exploitation may require multiple attempts, but the consequences of successful exploitation could include arbitrary code execution within the browser's sandbox.

Detection Methods for CVE-2024-8384

Indicators of Compromise

• Unusual memory consumption patterns in Firefox or Thunderbird processes prior to crashes
• Browser crashes with memory corruption signatures in crash reports
• JavaScript errors related to garbage collection or memory allocation failures in browser console logs
• Unexpected process termination of browser renderer processes with memory-related exit codes

Detection Strategies

• Monitor for abnormal memory allocation patterns in browser processes using endpoint detection capabilities
• Implement browser telemetry analysis to detect unusual garbage collection behavior or OOM condition frequencies
• Deploy network-level inspection to identify JavaScript payloads with memory exhaustion patterns
• Enable crash report analysis to identify memory corruption signatures consistent with this vulnerability

Monitoring Recommendations

• Configure SentinelOne agents to monitor Firefox and Thunderbird process behavior for memory corruption indicators
• Enable browser crash report collection and analysis for affected versions
• Implement web filtering to block known malicious domains serving exploitation attempts
• Monitor system resource usage for anomalous memory consumption by browser processes

How to Mitigate CVE-2024-8384

Immediate Actions Required

• Update Mozilla Firefox to version 130 or later immediately
• Update Mozilla Firefox ESR to version 128.2 or 115.15 or later
• Update Mozilla Thunderbird to version 128.2 or 115.15 or later
• Consider temporarily disabling JavaScript on untrusted websites until patching is complete
• Deploy browser update policies through enterprise management tools

Patch Information

Mozilla has released security patches addressing this vulnerability across multiple product lines. Organizations should apply the appropriate updates based on their deployment:

Additional details are available in Mozilla Bug Report #1911288. Debian users should also refer to the Debian LTS Security Announcements for package updates.

Workarounds

• Disable JavaScript execution in Firefox by setting javascript.enabled to false in about:config (significantly impacts web functionality)
• Use browser isolation or sandboxing technologies to limit the impact of potential exploitation
• Restrict browsing to trusted websites only until patches can be applied
• Consider using alternative browsers temporarily while awaiting patch deployment in enterprise environments

# Firefox configuration to disable JavaScript (temporary workaround)
# Navigate to about:config and set:
# javascript.enabled = false

# Enterprise deployment: Use Firefox policies.json
# Location: /distribution/policies.json (Linux) or install_directory\distribution\policies.json (Windows)
cat << 'EOF' > /usr/lib/firefox/distribution/policies.json
{
  "policies": {
    "DisableFirefoxAccounts": true,
    "ExtensionUpdate": false,
    "Preferences": {
      "javascript.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}
EOF