Skip to content

Memory Safety Issue when using patch or merge on state and assign the result back to state

Moderate severity GitHub Reviewed Published Sep 17, 2021 in tremor-rs/tremor-runtime • Updated Mar 30, 2023

Package

cargo tremor-script (Rust)

Affected versions

>= 0.7.3, < 0.11.6

Patched versions

0.11.6

Description

Impact

This vulnerability is a memory safety Issue when using patch or merge on state and assign the result back to state.
In this case affected versions of Tremor and the tremor-script crate maintains references to memory that might have been freed already. And these memory regions can be accessed by retrieving the state, e.g. send it over TCP or HTTP. This requires the Tremor server (or any other program using tremor-script) to execute a tremor-script script that uses the mentioned language construct.

Details

If affects the following two tremor-script language constructs:

  • A Merge where we assign the result back to the target expression
    and the expression to be merged needs to reference the event:
let state = merge state of event end;
  • A Patch where we assign the result back to the target expression
    and the patch operations used need to reference the event:
let state = patch state of insert event.key => event.value end;

For constructs like this (it does not matter what it references in the expression to be merged or the patch operations) an optimization
was applied to manipulate the target value in-place, instead of cloning it.

Our Value struct, which underpins all event data in tremor-script, is representing strings as borrowed beef::Cow<'lifetime, str>,
that reference the raw data Vec<u8> the event is based upon. We keep this raw byte-array next to the Value structure inside our Event as a self-referential struct,
so we make sure that the structured Value and its references are valid across its whole lifetime.

The optimization was considered safe as long as it was only possible to merge or patch event data or static data.
When state was introduced to tremor-script (in version 0.7.3) a new possibility to keep Value data around for longer than the lifetime of an event emerged.
If event data is merged or patched into state without cloning it first, it can still reference keys or values from
the previous event, which will now be invalid. This allows access to those already freed regions of memory and to get their content out over the wire.

Patches

The issue has been patched in https://crates.io/crates/tremor-script/0.11.6 and https://github.com/tremor-rs/tremor-runtime/releases/tag/v0.11.6 via commit 1a2efcd by removing the optimization
and always clone the target expression of a Merge or [Patch](https://www.tremor.rs/docs/tremor-script/index#patch.

Workarounds

If an upgrade is not possible, a possible workaround is to avoid the optimization
by introducing a temporary variable and not immediately reassigning to state:

let tmp = merge state of event end;
let state = tmp

References

The actual fix is applied in this PR: tremor-rs/tremor-runtime#1217

For more information

If you have any questions or comments about this advisory:

References

@mfelsche mfelsche published to tremor-rs/tremor-runtime Sep 17, 2021
Published by the National Vulnerability Database Sep 17, 2021
Reviewed Sep 17, 2021
Published to the GitHub Advisory Database Sep 20, 2021
Last updated Mar 30, 2023

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS score

0.314%
(71st percentile)

CVE ID

CVE-2021-39228

GHSA ID

GHSA-mc22-5q92-8v85
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.