1899973 - Event log ID 10, Firefox blocked from making system calls to Win32k.sys

Status: UNCONFIRMED

(External Software Affecting Firefox :: Other, defect, P5)

Description

[Tony Davis]

Attachment: EVENT_LOG_ID10_MS-Windows-Security-Mitigations.txt

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0

Steps to reproduce:

Normal Firefox usage today, but wanted to check my Windows Event Logs for something else.

Actual results:

Spotted a couple of hundred entries for EVENT ID 10 (Microsoft-Windows-Security-Mitigations):
"Process '\Device\HarddiskVolume3\Program Files\Mozilla Firefox\firefox.exe' (PID 9876) was blocked from making system calls to Win32k.sys."

Expected results:

Ideally, I should not be seeing these sort of event logs, for regular browser activity.

Comment 1

[Tony Davis]

Just in case it makes a difference, the reported system is running Windows 11 Pro, not windows 10. It is at version 23H2, OS Build 22631.3672.

Comment 2

[Max Christian Pohle [:/dev/max]]

Hi and thanks for reporting. I interpret the the attached log entry to belong to the content process, because Win32k.sys triggers the permission denied warning in it. For that reason I think this should be triaged by the DOM team.

Comment 3

[Bob Owen (:bobowen)]

Hi Tony, sorry for the delay, this is just a standard Windows message which will occur once for every process that has win32k disabled and tries to use it.

We shouldn't normally be trying to use win32k ourselves, although there might still be some edge cases where we do.
Does this happen for every firefox content process (command line ends with "tab" in the Details view of the event) that runs or only when you do certain things?

Another possibility is third party code (usually anti-virus or other security software) injected into our process that attempts to use win32k.
Do you have anything installed that might be doing this?

Comment 4

[Tony Davis]

Hi Bob, thanks for reaching out.
I can confirm that I AM running MalwareBytes Premium AV software on the PC, and the BrowserGuard Extension (Developed by MalwareBytes but it is NOT linked to the main AV), in Firefox.

Currently, looking at my event viewer, I see 584 ID 10 events (since 28th August), in the Security Mitigations -> Kernel Mode log. The majority (around 500), are from Firefox, and the rest are split between Adobe Reader, Dropbox, and PrintIsolationHost.exe.

As I can tell from WER (Windows Error Reports) viewer, Firefox DOES indeed get MalwareBytes Anti-Exploit DLL injected/Loaded when it starts up, as: LoadedModule[12]=C:\Program Files\Malwarebytes\Anti-Malware\mbae64.dll

Whether this is the cause of the win32k calls is hard to tell without internals knowledge, BUT as this is a 64-bit DLL, I am doubtful.

If there is anything else you need, don't hesitate to ask.

Comment 5

[Bob Owen (:bobowen)]

(In reply to Tony Davis from comment #4)
...

As I can tell from WER (Windows Error Reports) viewer, Firefox DOES indeed get MalwareBytes Anti-Exploit DLL injected/Loaded when it starts up, as: LoadedModule[12]=C:\Program Files\Malwarebytes\Anti-Malware\mbae64.dll

Whether this is the cause of the win32k calls is hard to tell without internals knowledge, BUT as this is a 64-bit DLL, I am doubtful.

Thanks for the quick response.
The 32 in win32k is a legacy from when the API was developed for 32-bit systems.
I believe it's been kept (like system32) on 64-bit systems for historical and compatibility reasons.
The win32k.sys (and friends) in system32 is 64-bit on 64-bit Windows.

I've installed MalwareBytes to get the DLL and it does indeed use things from user32.dll and ole32.dll.
It doesn't delay load the DLLs so they'll load when it does and their initialization will attempt to make win32k calls and cause those warnings.

I've confirmed that mbae64.dll is causing user32.dll etc. to load.
It appears to be the "Protection"->"Exploit protection" setting that causes the injection.
It only remains loaded in the parent process, so it looks like they are detecting the process type.
If they delay loaded user32.dll and ole32.dll (maybe others) then they possibly wouldn't be causing these warnings.

Comment 6

[Bob Owen (:bobowen)]

Hi Tony, if you turn off the "Protection"->"Exploit protection" setting in MalwareBytes and start Firefox, does this result in no win32k warnings?

It would be useful to confirm you get the same result, if we then contact MalwareBytes to see if they can resolve the issue.

Comment 7

[Tony Davis]

Hi Bob, sorry for the delay, had a couple of busy days.
I have just tested this, with the "Protection"->"Exploit protection" sett off in MalwareBytes, and it DOES stop the issue.

If you are able to take up the baton with MalwareBytes for this on my behalf, that would be great, as I do not have enough internals knowledge.

Comment 8

[Bob Owen (:bobowen)]

No problem and thanks for confirming.
We'll try and pass on this information to MalwareBytes.

Comment 9

[Tony Davis]

FYI: I am now using MalwareBytes 5.7.2.358 and it looks like they have fixed some Firefox interference issues (hanging Firefox when MWB stops and starts after updates etc). Certainly version 5.6.5 was supposed to stop it.

Here is what an AI search comes up with as regards Event ID 10 in the event viewer:
"Event ID 10 in the Microsoft-Windows-Security-Mitigations/KernelMode log is a normal security event and does not mean your computer is broken or infected.
This event is triggered because Firefox uses a proactive defence mechanism called Win32k Lockdown to prevent compromised browser processes from making direct system calls to the Windows kernel file win32k.sys.
What is Happening?
Modern web browsers isolate web pages into low-privilege "sandbox" processes. If malware executes on a website, it tries to escape the sandbox by targeting known vulnerabilities in win32k.sys (the Windows legacy graphics driver subsystem).
To shut down this entire attack vector, Mozilla Firefox blocks its own rendering and content processes from speaking to win32k.sys using the Windows operating system's built-in exploit mitigations.
When a background Firefox thread attempts to access a legacy graphic function out of habit, Windows blocks it as instructed and silently logs Event ID 10."

I am not sure if you need this kept open to cross-refer to if any other users sees a Firefox Related Event 10 for Win32k.sys?

Comment 10

[Bob Owen (:bobowen)]

(In reply to Tony Davis from comment #9)
...

I am not sure if you need this kept open to cross-refer to if any other users sees a Firefox Related Event 10 for Win32k.sys?

Hi Tony, I tried the two contacts we have for MalwareBytes last year, but got no reply.
(Sorry, I should have updated the bug with this.)
If this is still happening, I think we'll keep the bug open, as you say it makes it easier to find if people see the same thing and come to file a bug.

Comment 11

[Tony Davis]

Hi Bob, thanks for the quick reply. It could also be that the combination of the latest Windows Feature Update (26H2), Firefox 159, and Malwarebytes 5.7.2.358 has helped to mitigate these issues. It's a good idea to keep it open, in case some users don't have that combination, ans still get the issue for edge cases.

Comment 12

[Bob Owen (:bobowen)]

(In reply to Tony Davis from comment #11)

Hi Bob, thanks for the quick reply. It could also be that the combination of the latest Windows Feature Update (26H2), Firefox 159, and Malwarebytes 5.7.2.358 has helped to mitigate these issues. It's a good idea to keep it open, in case some users don't have that combination, ans still get the issue for edge cases.

Ah, perhaps I misunderstood, are you still getting the Event log ID 10 with the Exploit Protection setting enabled or has that been fixed as well?

Comment 13

[Tony Davis]

Hi Bob, sorry I gave you incorrect information. I was not looking in the correct part of Event Viewer (I could not find that Kernel Mode log).
I found a very useful command to use, to quickly get and see how many entries there are for a specific EVENT ID, in this case I just put 10 at the end of the command:
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-Security-Mitigations/KernelMode'; Id = 10 }

I can STILL see these (majority, several hundred for Firefox, just a few for Chrome, Dropbox, and Adobe) as the major updates to MalwareBytes tend to re-activate the Exploit Protection. It is STILL active, and I have a BUG report open with them as the Firefox Hang was occurring regularly with older releases of MalwareBytes, HOWEVER, they state that the fix for stopping Firefox Interference will not be out until END of October:
https://forums.malwarebytes.com/topic/337603-mwb-561257-still-causing-firefox-lockupnot-responding-after-a-restart/

Comment from a staff member:
"The actual update to correct the issue causing it has not been released yet. We're hoping it will be out at the end of October."

My feeling for the cause, is mainly MalwareBytes Premium (Exploit Protection), affecting Firefox, and the others (e.g. Dropbox, Chrome) are probably edge-cases.