GHSA-3fg9-hcq5-vxrc iana-time-zone vulnerable to use after free in MacOS / iOS implementation
A use-after-free bug in the MacOS/iOS implementation allows attackers to read random memory or execute code if the system time zone changes during execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3fg9-hcq5-vxrc?
GHSA-3fg9-hcq5-vxrc is an use after free vulnerability in iana-time-zone, published on 15 Aug 2022.
Official description
In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced.
The copied system time zone was released before its name was copied.
If the system time zone was changed between the call of CFRelease and str::to_owned(),
random memory would be copied.
Which versions are affected by GHSA-3fg9-hcq5-vxrc?
3 open source packages ship an affected version, including iana-time-zone.
| Package | Affected | Fixed in |
|---|---|---|
iana-time-zone crates.io | From 0.1.43 | 0.1.45 |
iana-time-zone crates.io | From 0.1.43 | 0.1.45 |
iana-time-zone crates.io | From 0.1.43 | 0.1.45 |
How do I fix GHSA-3fg9-hcq5-vxrc?
Upgrade iana-time-zone to 0.1.45 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is GHSA-3fg9-hcq5-vxrc being exploited?
There is no known exploitation of GHSA-3fg9-hcq5-vxrc in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2022-0049.