CVE-2021-45716

Vulnerability

A use-after-free vulnerability exists in the rusqlite crate for Rust, specifically in the Connection::create_collation function. The issue is caused by overly relaxed lifetime bounds on closures passed to this function, allowing a closure that references borrowed stack data to be invoked by SQLite after that data has been deallocated. The affected versions are 0.25.x before 0.25.4 and 0.26.x before 0.26.2. The function is available when the collation feature is enabled [1], [2], [4].

Exploitation

An attacker would need to craft a Rust program or library that calls create_collation with a closure capturing references to stack-allocated variables. When SQLite invokes the collation callback at a later point, the stack memory may have been freed and reused, leading to a use-after-free. No special network position or authentication is required beyond the ability to execute the vulnerable code path [2], [4].

Impact

Successful exploitation results in memory corruption, potentially allowing an attacker to read or write arbitrary memory locations. This could lead to information disclosure, denial of service, or in some cases arbitrary code execution, depending on the memory layout and how the dangling pointer is used [2], [4].

Mitigation

The vulnerability is fixed in rusqlite versions 0.25.4 and 0.26.2, released on December 9, 2021. Users should update to these patched versions. Versions prior to 0.25.0 are not affected. No workaround is available other than updating [2], [4].