1396030 - Load PKCS#11 modules in isolated processes

Status: NEW

(Core :: Security: PSM, defect, P2)

Description

[Kris Maglione [:kmag]]

With bug 1357391, PKCS#11 modules will become the easiest/only way for extensions to load native code into our privileged address space. I'm not sure how exploitable this is since bug 1299187, but it's still not a loophole that I'm happy opening. If there's a way to exploit it, I have no doubt that it will be exploited.

I talked to Keeler, and he thinks that loading PKCS#11 modules in isolated processes shouldn't be a lot of work. He even has a proof of concept:

https://github.com/mozkeeler/ooppkcs11

So perhaps it's time to prioritize this?

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

I think this is definitely a concern. Previously malware authors could just side-load add-ons into a user's profile. Now that we've raised the bar on that, the next easiest thing to do would be to modify the PKCS#11 module DB in a user's profile to load up a module at startup. Once that's accomplished, they can run arbitrary code in Firefox's process space. I realize that malware running locally is a hard threat to meaningfully defend against, but if I understand correctly that the purpose of requiring add-ons be signed was to raise the bar, we can and should keep going with doing the same for PKCS#11 modules.