Use-after-free through `init_using_cdict` and `init_using_ddict`
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.2.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Rust `zstd` bindings (zstd-rs) are affected through the experimental, deprecated `init_using_cdict` and `init_using_ddict` methods. A dictionary can be freed while a compression or decompression context still points to it, which can cause memory corruption or crashes.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
`CCtx::init_using_cdict` and `DCtx::init_using_ddict` (`experimental` feature, deprecated) took the dictionary as `&CDict<'b>` and `&DDict<'b>` with only `'b: 'a`, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier (<https://github.com/gyscos/zstd-rs/issues/365>). The flaw was corrected by taking `&'a CDict<'b>` and `&'a DDict<'b>`.
Timeline
- Advisory published
- Record last updated
Affected versions
- zstd-safecrates.io
From 3.0.0 · fixed in 8.2.0