CVE-2021-22930 Use After Free in node.js
An attacker can exploit a use-after-free vulnerability in Node.js to cause memory corruption, potentially leading to arbitrary code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22930?
CVE-2021-22930 is a critical use after free vulnerability in Debian Debian Linux, published on 7 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Weakness: CWE-416
Which versions are affected by CVE-2021-22930?
2 open source packages ship an affected version, including node and node-min. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | From 12.0.0 | 12.22.4, 14.17.4, 16.6.0 |
node-min Bitnami | From 12.0.0 | 12.22.4, 14.17.4, 16.6.0 |
Linux distribution packages (16)
nodejs8 SUSE:Enterprise Storage 6 | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 | All versions | 8.17.0-10.15.11 |
nodejs8 SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Linux Enterprise Server 15-LTSS | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Manager Proxy 4.0 | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Manager Retail Branch Server 4.0 | All versions | 8.17.0-3.50.1 |
nodejs8 SUSE:Manager Server 4.0 | All versions | 8.17.0-3.50.1 |
nodejs8 openSUSE:Leap 15.2 | All versions | 8.17.0-lp152.3.17.1 |
nodejs8 openSUSE:Leap 15.3 | All versions | 8.17.0-10.15.11 |
Products include Debian Debian Linux, Netapp Nextgen Api, Nodejs Node.js, Siemens Sinec Infrastructure Network Services.
How do I fix CVE-2021-22930?
Upgrade node to a fixed version for your release line: 12.22.4, 14.17.4 or 16.6.0.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2021-22930 being exploited?
There is no known exploitation of CVE-2021-22930 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-22930, AZL-6742, BIT-node-2021-22930, BIT-node-min-2021-22930, CLEANSTART-2026-JX16317, CLEANSTART-2026-TJ44267 and 9 more.