CVE Vulnerabilities

CVE-2025-1937

Improper Handling of Overlap Between Protected Memory Ranges

Published: Mar 04, 2025 | Modified: Mar 12, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
8.8 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.

Weakness

The product allows address regions to overlap, which can result in the bypassing of intended memory protection.

Affected Software

Name Vendor Start Version End Version
Red Hat Enterprise Linux 7 Extended Lifecycle Support RedHat firefox-0:128.8.0-1.el7_9 *
Red Hat Enterprise Linux 8 RedHat firefox-0:128.8.0-1.el8_10 *
Red Hat Enterprise Linux 8 RedHat thunderbird-0:128.8.0-2.el8_10 *
Red Hat Enterprise Linux 8.2 Advanced Update Support RedHat firefox-0:128.8.0-1.el8_2 *
Red Hat Enterprise Linux 8.2 Advanced Update Support RedHat thunderbird-0:128.8.0-2.el8_2 *
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support RedHat firefox-0:128.8.0-1.el8_4 *
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support RedHat thunderbird-0:128.8.0-2.el8_4 *
Red Hat Enterprise Linux 8.4 Telecommunications Update Service RedHat firefox-0:128.8.0-1.el8_4 *
Red Hat Enterprise Linux 8.4 Telecommunications Update Service RedHat thunderbird-0:128.8.0-2.el8_4 *
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions RedHat firefox-0:128.8.0-1.el8_4 *
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions RedHat thunderbird-0:128.8.0-2.el8_4 *
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support RedHat firefox-0:128.8.0-1.el8_6 *
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support RedHat thunderbird-0:128.8.0-2.el8_6 *
Red Hat Enterprise Linux 8.6 Telecommunications Update Service RedHat firefox-0:128.8.0-1.el8_6 *
Red Hat Enterprise Linux 8.6 Telecommunications Update Service RedHat thunderbird-0:128.8.0-2.el8_6 *
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions RedHat firefox-0:128.8.0-1.el8_6 *
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions RedHat thunderbird-0:128.8.0-2.el8_6 *
Red Hat Enterprise Linux 8.8 Extended Update Support RedHat firefox-0:128.8.0-1.el8_8 *
Red Hat Enterprise Linux 8.8 Extended Update Support RedHat thunderbird-0:128.8.0-2.el8_8 *
Red Hat Enterprise Linux 9 RedHat firefox-0:128.8.0-1.el9_5 *
Red Hat Enterprise Linux 9 RedHat thunderbird-0:128.8.0-2.el9_5 *
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions RedHat firefox-0:128.8.0-1.el9_0 *
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions RedHat thunderbird-0:128.8.0-2.el9_0 *
Red Hat Enterprise Linux 9.2 Extended Update Support RedHat firefox-0:128.8.0-1.el9_2 *
Red Hat Enterprise Linux 9.2 Extended Update Support RedHat thunderbird-0:128.8.0-2.el9_2 *
Red Hat Enterprise Linux 9.4 Extended Update Support RedHat firefox-0:128.8.0-1.el9_4 *
Red Hat Enterprise Linux 9.4 Extended Update Support RedHat thunderbird-0:128.8.0-2.el9_4 *
Firefox Ubuntu focal *
Mozjs102 Ubuntu esm-apps/noble *
Mozjs102 Ubuntu jammy *
Mozjs102 Ubuntu noble *
Mozjs115 Ubuntu devel *
Mozjs115 Ubuntu noble *
Mozjs115 Ubuntu oracular *
Mozjs52 Ubuntu esm-infra/bionic *
Mozjs52 Ubuntu focal *
Mozjs68 Ubuntu focal *
Mozjs78 Ubuntu jammy *
Mozjs91 Ubuntu jammy *
Thunderbird Ubuntu focal *
Thunderbird Ubuntu jammy *

Extended Description

Isolated memory regions and access control (read/write) policies are used by hardware to protect privileged software. Software components are often allowed to change or remap memory region definitions in order to enable flexible and dynamically changeable memory management by system software. If a software component running at lower privilege can program a memory address region to overlap with other memory regions used by software running at higher privilege, privilege escalation may be available to attackers. The memory protection unit (MPU) logic can incorrectly handle such an address overlap and allow the lower-privilege software to read or write into the protected memory region, resulting in privilege escalation attack. An address overlap weakness can also be used to launch a denial of service attack on the higher-privilege software memory regions.

Potential Mitigations

  • Ensure that memory regions are isolated as intended and that access control (read/write) policies are used by hardware to protect privileged software.
  • For all of the programmable memory protection regions, the memory protection unit (MPU) design can define a priority scheme.
  • For example: if three memory regions can be programmed (Region_0, Region_1, and Region_2), the design can enforce a priority scheme, such that, if a system address is within multiple regions, then the region with the lowest ID takes priority and the access-control policy of that region will be applied. In some MPU designs, the priority scheme can also be programmed by trusted software.
  • Hardware logic or trusted firmware can also check for region definitions and block programming of memory regions with overlapping addresses.
  • The memory-access-control-check filter can also be designed to apply a policy filter to all of the overlapping ranges, i.e., if an address is within Region_0 and Region_1, then access to this address is only granted if both Region_0 and Region_1 policies allow the access.

References