CVE-2021-43790CWE-416

Use After Free in lucet

High · published November 29, 2021

CVSS v3.1
8.5
EPSS
2%
Percentile
75.8
In the wild
Unconfirmed
What it is

Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to crates.io that allows a use-after-free in an Instance object that could result in memory corruption, data race, or other related issues. This bug was introduced early in the development of Lucet and is present in all releases. As a result of this bug, and dependent on the memory backing for the Instance objects, it is possible to trigger a use-after-free when the Instance is dropped. Users should upgrade to the main branch of the Lucet repository. Lucet no longer provides versioned releases on crates.io. There is no way to remediate this vulnerability without upgrading.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01617 · 75.8th percentile
Weakness
CWE-416 · Use After Free
Published
2021-11-29T23:55Z
EPSS history
Timeline
  • 29 NOV 23:55Z
    Use After Free in lucet
    cvelistv5