Closed Bug 1608671 Opened 4 years ago Closed 4 years ago

Crash in [@ LdrpSnapModule] caused by Microsoft's EMET

Categories

(External Software Affecting Firefox :: Other, defect, P3)

Unspecified
Windows
defect

Tracking

(Not tracked)

RESOLVED DUPLICATE of bug 1509748

People

(Reporter: yoasif, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug is for crash report bp-2a226846-244c-4c63-96a4-f84770200111.

Top 6 frames of crashing thread:

0 ntdll.dll LdrpSnapModule 
1 ntdll.dll LdrpMapAndSnapModules 
2 ntdll.dll LdrpPrepareModuleForExecution 
3 ntdll.dll LdrpLoadDll 
4 ntdll.dll LdrLoadDll 
5 emet64.dll emet64.dll@0x47fd9 

Also reported in https://www.reddit.com/r/firefox/comments/enge0k/since_updating_to_ff72_ive_had_several_random_tab/

emet64.dll appears to be a common reference. That is part of Microsoft EMET (Enhanced Mitigation Experience Toolkit). I've used EMET for years, and never had a problem between it and Firefox until today.

OS: Windows 8 → Windows

Sending to Widget:Win32 for a first look.

Component: General → Widget: Win32

The priority flag is not set for this bug.
:jimm, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(jmathies)
Component: Widget: Win32 → Other
Flags: needinfo?(jmathies) → needinfo?(tkikuchi)
Priority: -- → P3
Product: Core → External Software Affecting Firefox
Summary: Crash in [@ LdrpSnapModule] → Crash in [@ LdrpSnapModule] caused by Microsoft's EMET
Version: 72 Branch → unspecified

Probably this is caused by EAF (= Export Address Filtering). Can you disable EAF/EAF+ for firefox.exe and see the crash still happens or not? As discussed in Bug 1509748, it's not guaranteed that firefox works with EAF.

I think our blocklist can block emet64.dll, but it means all EMET mitigations would be implicitly disabled in firefox. If the problem is only EAF, we don't want to disable the other mitigations.

Flags: needinfo?(tkikuchi)
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.