PT-2024-22148 · Deno · Deno

Leesh3288 · Published 2024-03-06 · Updated 2025-01-03 · CVE-2024-27934

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deno versions 1.36.2 through 1.40.3

Description The issue arises from the use of inherently unsafe *const c void and ExternalPointer which leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. An attacker controlling the code executed inside a Deno runtime can exploit this to obtain arbitrary code execution on the host machine regardless of permissions. The vulnerability is known to be exploitable for both *const c void and ExternalPointer implementations.

Recommendations For Deno versions 1.36.2 through 1.40.2, update to version 1.40.3 to fix the issue. For Deno versions prior to 1.36.2, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of *const c void and ExternalPointer to minimize the risk of exploitation.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2024-27934

GHSA-3J27-563V-28WF

Affected Products

Deno

References · 7

• 🔥 https://github.com/denoland/deno/security/advisories/GHSA-3j27-563v-28wf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27934.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-27934 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3j27-563v-28wf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27934 · Security Note
• https://github.com/denoland/deno · Note
• https://twitter.com/cracbot/status/1771321520205300067 · Twitter Post