CVE-2023-29537

Vulnerability

Multiple race conditions exist in the font initialization code of Firefox, Firefox for Android, and Focus for Android prior to version 112. Specifically, a race condition in MakeGlyphAtlas() within gfxFontMissingGlyphs.cpp (bug 1823365 [1]) and additional data races in the fontconfig/FreeType backend (bug 1824200 [2]) and the Android FT2 font backend (bug 1825569 [4]) allow multiple threads to concurrently access and modify static or shared font resources. An attacker can trigger these races by crafting HTML/JavaScript that calls font rendering functions from web workers, causing a use-after-free or memory corruption when two threads pass the null check on the same variable and subsequently perform unsynchronized assignments.

Exploitation

An attacker needs to deliver a specifically crafted HTML file that triggers the race condition, typically by using JavaScript to call fillText() with certain Unicode characters from a web worker. The attack requires no authentication or special privileges; a victim merely visiting a malicious webpage suffices. By exploiting the race window, an attacker can cause a use-after-free in the MakeGlyphAtlas() function, where one thread frees a SourceSurface object while the other thread continues to use it [1]. The data races in the font backends [2][4] similarly allow concurrent read/write operations on shared FreeType faces, potentially leading to memory corruption.

Impact

Successful exploitation can lead to memory corruption and arbitrary code execution within the content process, with high severity as rated by Mozilla [3]. The attacker gains the ability to execute attacker-controlled code, potentially leading to full compromise of the browser sandbox, access to sensitive data, or further system compromise.

Mitigation

The vulnerabilities are fixed in Firefox 112, Firefox for Android 112, and Focus for Android 112, released on April 11, 2023 [3]. Users should update their browsers to the latest version. No workarounds are provided; updating is the only mitigation. The fixes involve proper synchronization (atomics, locking) in the affected code paths [1][2][4].