PT-2021-24288 · Rusqlite · Rusqlite

Published 2021-12-07 · Updated 2022-06-17 · CVE-2021-45714

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: rusqlite crate versions 0.25.0 through 0.25.3 rusqlite crate versions 0.26.0 through 0.26.1

Description: The issue is related to several closure-accepting functions in the rusqlite crate, which have a too relaxed lifetime bound. This can allow Rust code to access objects on the stack after they have been dropped, specifically when a closure referencing borrowed values on the stack is passed to one of these functions. The impacted functions include Connection::create scalar function, Connection::create aggregate function, Connection::create window function, Connection::commit hook, Connection::rollback hook, Connection::update hook, and Connection::create collation.

Recommendations: For rusqlite crate versions 0.25.0 through 0.25.3, update to version 0.25.4 or newer. For rusqlite crate versions 0.26.0 through 0.26.1, update to version 0.26.2 or newer.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-45714

GHSA-4QR3-M7WW-HH9G

GHSA-87XH-9Q6H-R5CC

GHSA-92CX-4XM7-JR9M

GHSA-CM8G-544F-P9X9

GHSA-F6F2-3W33-54R9

GHSA-G4G4-3PQW-8M7F

GHSA-G87R-23VW-7F87

GHSA-Q89G-4VHH-MVVM

RUSTSEC-2021-0128

Affected Products

Rusqlite

References · 28

• 🔥 https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md · Exploit
• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0128.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45717 · Security Note
• https://osv.dev/vulnerability/GHSA-f6f2-3w33-54r9 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0128 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q89g-4vhh-mvvm · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g87r-23vw-7f87 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45715 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-45714 · Security Note
• https://osv.dev/vulnerability/GHSA-cm8g-544f-p9x9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-87xh-9q6h-r5cc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45714 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45713 · Security Note
• https://osv.dev/vulnerability/GHSA-92cx-4xm7-jr9m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45719 · Security Note