CVE-2024-45773 Use after free in Facebook Thrift
A use-after-free flaw in Facebook Thrift allows attackers to cause crashes or potentially execute arbitrary code via upgradeToRocket requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45773?
CVE-2024-45773 is a high-severity use after free vulnerability in Facebook Thrift, published on 27 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00.
Which versions are affected by CVE-2024-45773?
How do I fix CVE-2024-45773?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-45773 being exploited?
There is no known exploitation of CVE-2024-45773 in the wild and no public exploit code.
Sources
Also known as AZL-49728, GHSA-vww8-5r8j-mrcr.