Log in Start free

Vulnerability · Published Sep 17, 2021 · Assigned by GitHub_M

CVE-2021-39228Memory Safety Issue when using patch or merge on state and assign the result back to state

Medium 6.5

In plain English

A medium-severity use-after-free in tremor-runtime from tremor-rs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.3%top 28.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`. In this case, affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the `state`, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct. The issue has been patched in version 0.11.6 by removing the optimization and always cloning the target expression of a Merge or Patch. If an upgrade is not possible, a possible workaround is to avoid the optimization by introducing a temporary variable and not immediately reassigning to `state`.

Affected products (as reported)

VendorProductVersions
tremor-rs tremor-runtime > 0.7.2, < 0.11.6

Weakness: CWE-416, CWE-825 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References