# CVE-2020-6820: Firefox use-after-free in Cache

Use-after-free of CacheStreamControlParent in Firefox's cache IPDL layer when closing the last open read stream; chained with CVE-2020-6819 as a sandbox escape in a real zero-day attack.

- Payout: Real-world hack
- Severity: high
- Program: Mozilla
- Analysis by: Maddie Stone
- Disclosed: 2020-04-03
- CVE: CVE-2020-6820
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2020/CVE-2020-6820.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2020-6820
- Tags: area:os domain:browser impact:rce kind:incident platform:project-zero sev:high tech:firefox technique:chained technique:source-review vuln:memory-corruption vuln:race-condition

**Target:** Firefox cache IPDL interface (PCacheStreamControlParent / StreamList) in the browser process
**Root cause:** StreamList::CloseAll frees the CacheStreamControlParent via Shutdown/Send__delete when the last read stream is closed, then PCacheStreamControlParent::SendCloseAll accesses the freed object's mId.
**Steps:**
1. Trigger a cache query so the content process holds an open ReadStream on CacheStreamControlParent.
2. Send a close or abort command while read streams are still open, invoking StreamList::CloseAll.
3. CloseAll -> CacheStreamControlParent::CloseAll -> NotifyCloseAll -> StreamControl::CloseAllReadStreams -> ReadStream::Inner::CloseStream/Close/NoteClosed -> StreamControl::NoteClosed -> ForgetReadStream -> NoteClosedAfterForget -> RecvNoteClosed -> StreamList::NoteClosed.
4. With StreamList empty and mStreamControl set, CacheStreamControlParent::Shutdown runs Send__delete(this), freeing the object.
5. Return to PCacheStreamControlParent::SendCloseAll, which calls Id() on the freed mId, causing the UaF.
**How found:** Project Zero root-cause analysis of an in-the-wild zero-day; the write-up hypothesizes the bug was found via manual code auditing/variant analysis of the similar Bug 1507180 patch, or by fuzzing IPDL interfaces.
**Exploitation:** Unknown per the write-up; used in the wild as the sandbox-escape stage of a two-CVE chain with CVE-2020-6819 (renderer exploit), discovered after visiting a threat-actor-affiliated URL with ASAN Firefox builds.
**Escalation:** Chained renderer compromise (CVE-2020-6819) with this browser-process UaF (CVE-2020-6820) to escape the sandbox.
**Insight:** The IPDL Cache subsystem's stream-close path has produced repeated UaFs (Bug 1507180, this bug, Bug 1655115); audit CloseAll/NoteClosed/Shutdown ordering where Send__delete can free an actor mid-call and a later Id() dereferences it.