Mozilla Firefox Keyboard Event timing discrepancy

Summaryinfo

A vulnerability was found in Mozilla Firefox. It has been rated as problematic. This vulnerability affects unknown code of the component Keyboard Event Handler. Performing a manipulation results in timing discrepancy. This vulnerability is known as CVE-2022-45416. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Mozilla Firefox (Web Browser) (version unknown). This affects an unknown function of the component Keyboard Event Handler. The manipulation with an unknown input leads to a timing discrepancy vulnerability. CWE is classifying the issue as CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. This is going to have an impact on confidentiality. The summary by CVE is:

Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

The weakness was published 12/23/2022. It is possible to read the advisory at mozilla.org. This vulnerability is uniquely identified as CVE-2022-45416 since 11/14/2022. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 249965 (Linux Distros Unpatched Vulnerability : CVE-2022-45416), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at mozilla.org.

The vulnerability is also documented in the vulnerability database at Tenable (249965). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion