Closed
Bug 1572164
Opened 6 years ago
Closed 5 years ago
Use-after-Free in NSC_WrapKey
Categories
(NSS :: Libraries, defect, P2)
NSS
Libraries
Tracking
(Not tracked)
RESOLVED
FIXED
3.46
People
(Reporter: jcj, Assigned: kjacobs)
References
Details
(Keywords: csectype-uaf, sec-audit)
Crash Data
Attachments
(1 file)
Audit of NSC_WrapKey revealed that SFTKSession *session is used in its error legs after being freed: https://searchfox.org/mozilla-central/rev/9ae20497229225cb3fa729a787791f424ff8087b/security/nss/lib/softoken/pkcs11c.c#5608
This appears as a crash signature for NSC_WrapKey, which is accessible via WebCrypto. It's not a common crash, but is clear from inspection.
|
Reporter | |
Updated•6 years ago
|
Crash Signature: NSC_WrapKey → [@ NSC_WrapKey ]
|
Assignee | |
Comment 1•5 years ago
|
||
|
|
Reporter | |
Comment 2•5 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → 3.46
|
||
Updated•5 years ago
|
Group: crypto-core-security → core-security-release
|
|
||
Updated•4 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•