firefox crashes on a FIPS enabled machine
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Mozilla Firefox |
Fix Released
|
Medium
|
|||
firefox (Ubuntu) |
Fix Released
|
High
|
Vineetha Kamath |
Bug Description
[IMPACT]
firefox is not a FIPS certified library. firefox uses bundled nss and on a machine running FIPS enabled kernel, nss by default goes into FIPS mode if /proc/sys/
The proposed patch disables reading the /proc/sys/
The issue impacts firefox versions in eoan, disco, bionic and xenial.
lsb_release -rd
Description: Ubuntu Eoan Ermine (development branch)
Release: 19.10
Version: 2:3.45-1ubuntu1
lsb_release -rd
Description: Ubuntu Disco Dingo
Release: 19.04
Version: 2:3.42-1ubuntu2
lsb_release -rd
Description: Ubuntu Bionic Beaver
Release: 18.04
Version: 2:3.35-2ubuntu2.3
lsb_release -rd
Description: Ubuntu 16.04.3 LTS
Release: 16.04
Version: 2:3.28.
[FIX]
This fix proposes to disable bundled nss in firefox reading proc/sys/
Users who do want to run the library in FIPS mode can do so by using the environment variable "NSS_FIPS". We propose to leave it as is so as not to regress anyone using this. The user who is using this option should be doing so with the awareness.
[TEST]
Tested on a xenial and bionic desktop ISO running FIPS enabled kernel and in FIPS mode. With the patch fix no crashes were observed when launching firefox browser.
Without the patch fix, firefox crashes.
Tested on a xenial and bionic desktop ISO running non-FIPS generic kernel. With the patch fix, firefox worked as expected and no changes were observed.
[REGRESSION POTENTIAL]
The regression potential for this is small. A FIPS kernel is required to
create /proc/sys/
description: | updated |
Changed in firefox: | |
importance: | Unknown → Medium |
status: | Unknown → New |
tags: | added: sts |
Changed in firefox (Ubuntu): | |
status: | New → Confirmed |
importance: | Undecided → High |
tags: | added: sts-sponsor-slashd |
Changed in firefox: | |
status: | New → Fix Released |
The build log and test runs for eoan build is on my test ppa /launchpad. net/~vineetha/ +archive/ ubuntu/ firefox- test/+build/ 17525936
https:/
The build log and test runs for disco build is on my test ppa /launchpad. net/~vineetha/ +archive/ ubuntu/ firefox- test/+build/ 17525851
https:/
The build log and test runs for bionic build is on my test ppa /launchpad. net/~vineetha/ +archive/ ubuntu/ test-ppa/ +build/ 17524983
https:/
The build log and test runs for xenial build is on my test ppa /launchpad. net/~vineetha/ +archive/ ubuntu/ firefox- test/+build/ 17525924
https:/