bytecodealliance lucet 释放后使用

CVE编号

CVE-2021-43790

利用情况

暂无

补丁情况

N/A

披露时间

2021-11-30

漏洞描述

Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that allows a use-after-free in an Instance object that could result in memory corruption, data race, or other related issues. This bug was introduced early in the development of Lucet and is present in all releases. As a result of this bug, and dependent on the memory backing for the Instance objects, it is possible to trigger a use-after-free when the Instance is dropped. Users should upgrade to the main branch of the Lucet repository. Lucet no longer provides versioned releases on crates.io. There is no way to remediate this vulnerability without upgrading.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://crates.io/crates/lucet-runtime
https://github.com/bytecodealliance/lucet/commit/7c7757c772fb709c61b1442bcc1e...
https://github.com/bytecodealliance/lucet/security/advisories/GHSA-hf79-8hjp-rrvq

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	bytecodealliance	lucet	*		Up to (including) 0.6.1

CVSS3评分 8.5

• 攻击路径 网络
• 攻击复杂度 高
• 权限要求 低
• 影响范围 已更改
• 用户交互 无
• 可用性 高
• 保密性 高
• 完整性 高

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CWE-ID 漏洞类型 CWE-416 释放后使用