PT-2021-24276 · Unknown · Tremor-Script

Published

2021-09-16

·

Updated

2022-06-17

·

CVE-2021-45702

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: tremor-script versions prior to 0.11.6
Description: The issue is related to a use-after-free error in the tremor-script crate for Rust. It affects the Merge and Patch language constructs when they reference the event and assign the result back to the target expression. The optimization to manipulate the target value in-place, instead of cloning it, can lead to accessing already freed regions of memory. This allows access to those already freed regions of memory and to get their content out over the wire.
Recommendations: For versions prior to 0.11.6, upgrade to version 0.11.6 or later to fix the issue. As a temporary workaround, avoid the optimization by introducing a temporary variable and not immediately reassigning to state, for example:
let tmp = merge state of event end;
let state = tmp

Fix

Use After Free

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2021-45702
GHSA-3PP4-64MP-9CG9
GHSA-9QVW-46GF-4FV8
GHSA-Q2X5-6Q7Q-R872
RUSTSEC-2021-0111

Affected Products

Tremor-Script