// For flags

CVE-2021-39228

Memory Safety Issue when using patch or merge on state and assign the result back to state

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is a memory safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`. In this case, affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the `state`, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct. The issue has been patched in version 0.11.6 by removing the optimization and always cloning the target expression of a Merge or Patch. If an upgrade is not possible, a possible workaround is to avoid the optimization by introducing a temporary variable and not immediately reassigning to `state`.

Tremor es un sistema de procesamiento de eventos para datos no estructurados. Se presenta una vulnerabilidad entre las versiones 0.7.2 y 0.11.6. Esta vulnerabilidad es un problema de seguridad de memoria cuando es usado "patch" o "merge" en "state" y se asigna el resultado de nuevo a "state". En este caso, las versiones afectadas de Tremor y el crate tremor-script mantienen referencias a la memoria que podrían haber sido liberadas ya. Y estas regiones de memoria pueden ser accedidas al recuperar el "state", por ejemplo, enviándolo por TCP o HTTP. Esto requiere que el servidor Tremor (o cualquier otro programa usando tremor-script) ejecute un script tremor-script que use la construcción de lenguaje mencionada. El problema ha sido parcheado en la versión 0.11.6, al eliminar la optimización y clonando siempre la expresión de destino de una Fusión o Parche. Si no es posible una actualización, una posible solución es evitar la optimización introduciendo una variable temporal y no reasignando inmediatamente a "state"

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-08-16 CVE Reserved
  • 2021-09-17 CVE Published
  • 2024-06-02 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-416: Use After Free
  • CWE-825: Expired Pointer Dereference
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linuxfoundation
Search vendor "Linuxfoundation"
 Tremor
Search vendor "Linuxfoundation" for product "Tremor"
 >= 0.7.2 < 0.11.6
Search vendor "Linuxfoundation" for product "Tremor" and version " >= 0.7.2 < 0.11.6"
-
Affected