CVE-2021-45717

Vulnerability

A use-after-free vulnerability exists in the rusqlite crate for Rust, specifically in the commit_hook function under the hooks feature. The issue arises from incorrect lifetime bounds on closures passed to this function. If a closure referencing borrowed data on the stack is provided, it can allow access to that data after it has been dropped. Affected versions are 0.25.x before 0.25.4 and 0.26.x before 0.26.2 [2][4].

Exploitation

An attacker must be able to call Connection::commit_hook with a closure that captures borrowed references to stack-allocated data. When a commit operation occurs, the closure is invoked by SQLite after the borrowed data may have been deallocated, leading to a use-after-free condition. No special network position or authentication is required beyond the ability to execute Rust code using the vulnerable crate [2][4].

Impact

Successful exploitation results in memory corruption, which can lead to arbitrary code execution, information disclosure, or denial of service. The attacker gains the ability to read or write freed memory, potentially compromising the integrity and confidentiality of the application [2][4].

Mitigation

The vulnerability is fixed in versions 0.25.4 and 0.26.2 of the rusqlite crate. Users should upgrade to these or later versions. No workarounds are documented; the only mitigation is to update the dependency [2][4].