CVE-2021-45715

Vulnerability

A use-after-free vulnerability exists in the rusqlite crate for Rust, specifically in the create_window_function method (and other callback-registering functions) when the functions feature is enabled. The issue arises from incorrect lifetime bounds on closures passed to these functions, allowing a closure that references borrowed stack data to be invoked after the data has been dropped. Affected versions are 0.25.0 through 0.25.3 and 0.26.0 through 0.26.1 [2][4].

Exploitation

An attacker must convince a user to call create_window_function (or similar functions like create_scalar_function, create_aggregate_function) with a closure that captures borrowed values from the stack. If the closure is later invoked by SQLite after those stack frames have been deallocated, accessing the captured data results in undefined behavior, including use-after-free. The attack requires the user to compile and run code using the vulnerable crate under the affected version range [2][4].

Impact

Successful exploitation leads to memory corruption, which can cause a crash or, in worst case, arbitrary code execution. The vulnerability is classified as memory corruption and can compromise the confidentiality, integrity, and availability of the application [2][4].

Mitigation

Users should upgrade to rusqlite version 0.26.2 or 0.25.4, which contain the fix for this issue. Alternatively, restrict use of the functions feature if upgrading is not immediately possible. No workaround other than patching is known [2][4].