PT-2021-23936 · Lucet · Lucet

Highpchicken · Published 2021-11-29 · Updated 2021-12-01 · CVE-2021-43790

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Lucet versions prior to the main branch

Description: There is a bug in the lucet-runtime that allows a use-after-free in an Instance object, potentially resulting in memory corruption, data race, or other related issues. This bug was introduced early in the development of Lucet and is present in all releases. The bug is related to the InstanceHandle type and the pool allocator used for new WebAssembly instances. When an Instance is dropped, the fields of the Instance are destructed top-to-bottom, but the memory backing the Instance is released back to the pool before the destructors of the remaining fields are run, potentially leading to a race condition and use-after-free errors.

Recommendations: Upgrade to the main branch of the Lucet repository, as there is no way to remediate this vulnerability without upgrading.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-43790

GHSA-HF79-8HJP-RRVQ

RUSTSEC-2021-0155

Affected Products

Lucet

References · 11

• 🔥 https://github.com/bytecodealliance/lucet/security/advisories/GHSA-hf79-8hjp-rrvq · Exploit
• https://github.com/bytecodealliance/lucet/commit/7c7757c772fb709c61b1442bcc1e1fbee97bf4a8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-43790 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2021-0155 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hf79-8hjp-rrvq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43790 · Vendor Advisory
• https://github.com/bytecodealliance/lucet · Note
• https://crates.io/crates/lucet-runtime · Note
• https://t.me/cvenotify/23963 · Telegram Post
• https://t.me/cvenotify/23959 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2021-0155.html · Note