CVE-2021-24028 Use after free in Facebook Thrift

What is CVE-2021-24028?

CVE-2021-24028 is a critical use after free vulnerability in Facebook Thrift, published on 13 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00.

Weakness: CWE-763

Which versions are affected by CVE-2021-24028?

It affects 1 product.

Products include Facebook Thrift.

How do I fix CVE-2021-24028?

No fix has been published for CVE-2021-24028 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2021-24028 being exploited?

There is no known exploitation of CVE-2021-24028 in the wild and no public exploit code.

Other vulnerabilities in Facebook Thrift

• CVE-2019-11939 Golang Facebook Thrift servers vulnerable to denial of service High 7.5
• CVE-2019-11938 Denial of service in Facebook Thrift High 7.5
• CVE-2019-3553 Denial of service in Facebook Thrift High 7.5
• CVE-2019-3552 Denial of service in Facebook Thrift High 7.5
• CVE-2019-3558 Denial of service in Facebook Thrift High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qrr3-c36x-2pcc.