PT-2024-21792 · Unknown · Cassandra-Rs

Castlequirm · Published 2024-02-28 · Updated 2025-04-01 · CVE-2024-27284

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions cassandra-rs versions prior to 3.0.0

Description The issue is related to a use-after-free bug in the cassandra-rs driver for Rust. Code that attempts to use an item returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behavior. This problem has always existed and is rated high severity. However, such code will almost always fail immediately, making it unlikely that any code using this pattern would have reached production.

Recommendations For versions prior to 3.0.0, upgrade to version 3.0.0 to ensure the code cannot use the problematic pattern. As a temporary workaround, ensure all usage fits the expected pattern, for example, use get first row() rather than an iterator, or completely process an item before advancing the iterator with next().

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2024-27284

GHSA-X9XC-63HG-VCFQ

RUSTSEC-2024-0017

Affected Products

Cassandra-Rs

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27284.json · Exploit
• https://github.com/Metaswitch/cassandra-rs/security/advisories/GHSA-x9xc-63hg-vcfq · Vendor Advisory
• https://github.com/Metaswitch/cassandra-rs/commit/ae054dc8044eac9c2c7ae2b1ab154b53ca7f8df7 · Patch
• https://osv.dev/vulnerability/CVE-2024-27284 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x9xc-63hg-vcfq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27284 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2024-0017 · Vendor Advisory
• https://github.com/Metaswitch/cassandra-rs · Note
• https://crates.io/crates/cassandra-cpp · Note
• https://twitter.com/CVEnew/status/1762868331726373306 · Twitter Post
• https://t.me/cvenotify/117221 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2024-0017.html · Note
• https://twitter.com/VulmonFeeds/status/1763093033183043970 · Twitter Post