iana-time-zone vulnerable to use after free in MacOS / iOS implementation

published 2022-08-15 4y ago modified 2023-11-08 3y ago also RUSTSEC-2022-0049

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced.

The copied system time zone was released before its name was copied. If the system time zone was changed between the call of `CFRelease` and `str::to_owned()`, random memory would be copied.

Patch / fix

fixed in 1 links 2

crates.io iana-time-zone 0.1.45

github.com/strawlab/iana-time-zone#54 pull request
github.com/strawlab/iana-time-zone#50 pull request

Is GHSA-3fg9-hcq5-vxrc in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
crates.io	iana-time-zone	>=0.1.43, <0.1.45	0.1.45

Classification

Weakness

CWE-416 Use After Free

References

github.com /strawlab/iana-time-zone/pull/54
web
github.com /strawlab/iana-time-zone/pull/50#discussion_r945353515
web
github.com /strawlab/iana-time-zone
package
rustsec.org /advisories/RUSTSEC-2022-0049.html
web, advisory
crates.io /crates/iana-time-zone
package

Sources

GitHub Advisory GHSA-3fg9-hcq5-vxrc
OSV RUSTSEC-2022-0049

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.