Use-after-free when changing a multithreaded context with an unfinished frame
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.2.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
This vulnerability affects applications using the Rust zstd bindings with multithreaded compression enabled, where changing dictionaries or worker settings on an unfinished compression context can cause memory corruption. Successfully triggering it could lead to a use-after-free, which may crash the program or potentially allow other unintended behavior.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
When a multithreaded frame (`zstdmt` feature, `CParameter::NbWorkers`) is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes the context accept changes again in the meantime, so: • unloading the dictionary (`load_dictionary`, `ref_cdict`, `ref_prefix`, `disable_dictionary`, `init*`, or `reset` with parameters) freed the dictionary a worker was still compressing against; • changing `NbWorkers` made the next frame resize the job table before waiting for the old jobs. The flaw was corrected by refusing these calls while a multithreaded frame is unfinished. The new `CCtx::wait_for_workers()` waits for the workers first.
Timeline
- Advisory published
- Record last updated
Affected versions
- zstd-safecrates.io
From 0.0.0-0 · fixed in 8.2.0