PT-2021-24289 · Rusqlite · Rusqlite

Published 2021-12-07 · Updated 2022-06-17 · CVE-2021-45715

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: rusqlite versions 0.25.0 through 0.25.3 rusqlite versions 0.26.0 through 0.26.1

Description: The issue is related to several closure-accepting functions in the rusqlite crate, which have a too relaxed lifetime bound. This can allow Rust code to access objects on the stack after they have been dropped, resulting in a use-after-free issue. The impacted functions include create scalar function, create aggregate function, create window function, commit hook, rollback hook, update hook, and create collation.

Recommendations: For rusqlite versions 0.25.0 through 0.25.3, upgrade to version 0.25.4 or newer. For rusqlite versions 0.26.0 through 0.26.1, upgrade to version 0.26.2 or newer.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-45715

GHSA-4QR3-M7WW-HH9G

GHSA-87XH-9Q6H-R5CC

GHSA-92CX-4XM7-JR9M

GHSA-CM8G-544F-P9X9

GHSA-F6F2-3W33-54R9

GHSA-G4G4-3PQW-8M7F

GHSA-G87R-23VW-7F87

GHSA-Q89G-4VHH-MVVM

RUSTSEC-2021-0128

Affected Products

Rusqlite

References · 28

• 🔥 https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md · Exploit
• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0128.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45717 · Security Note
• https://osv.dev/vulnerability/GHSA-f6f2-3w33-54r9 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0128 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q89g-4vhh-mvvm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45715 · Security Note
• https://osv.dev/vulnerability/GHSA-g87r-23vw-7f87 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cm8g-544f-p9x9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45714 · Security Note
• https://osv.dev/vulnerability/GHSA-87xh-9q6h-r5cc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45715 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45713 · Security Note
• https://osv.dev/vulnerability/GHSA-92cx-4xm7-jr9m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45719 · Security Note