CVE-2021-39228 Memory Safety Issue when using patch or merge on state and assign the result back to state
Attackers can trigger memory corruption in Tremor by exploiting a use-after-free bug in state patching, potentially leading to code execution or data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-39228?
CVE-2021-39228 is a medium-severity use after free vulnerability in tremor-rs tremor-runtime, published on 17 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`. In this case, affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the `state`, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct. The issue has been patched in version 0.11.6 by removing the optimization and always cloning the target expression of a Merge or Patch. If an upgrade is not possible, a possible workaround is to avoid the optimization by introducing a temporary variable and not immediately reassigning to `state`.
Which versions are affected by CVE-2021-39228?
2 open source packages ship an affected version, including tremor-script. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tremor-script crates.io | From 0.7.3 | 0.11.6 |
tremor-script crates.io | From 0.7.3 | 0.11.6 |
Products include Linuxfoundation Tremor.
How do I fix CVE-2021-39228?
Upgrade tremor-script to 0.11.6 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2021-39228 being exploited?
There is no known exploitation of CVE-2021-39228 in the wild and no public exploit code.
Sources
Also known as GHSA-mc22-5q92-8v85.