- Reported
-
- Issued
-
- Package
-
surrealdb
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#use-after-free
#lifetime-erasure
#leak
- Aliases
-
- References
-
- CVSS Score
- 7.8
HIGH
- CVSS Details
-
- Attack Vector
- Local
- Attack Complexity
- High
- Privileges Required
- Low
- User Interaction
- None
- Scope
- Changed
- Confidentiality Impact
- High
- Integrity Impact
- High
- Availability Impact
- High
- CVSS Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- Patched
-
Description
The kv-mem, kv-surrealkv and kv-rocksdb backends move non-'static borrowed state into affinity-pool closures through affinitypool::spawn_local: a tokio::sync::MutexGuard<Option<TransactionInner>>, &Transaction, &mut ScanStateKeys/Vals, &mut dyn KeyVisitor/ValVisitor, RwLockReadGuard, and a ReadOptions holding a raw rocksdb_snapshot_t*. In affinitypool 0.7.0 spawn_local is safe and erases the 'pool lifetime via async_task::Builder::spawn_unchecked; the only thing keeping it sound is the Drop implementation of the returned future, which blocks until the worker stops using the borrows.
Safe code can leak that future (mem::forget, Box::leak, ManuallyDrop, a reference cycle, or a leaked enclosing future). The borrows then end while the pool worker still uses them, producing a use-after-free on the transaction allocation; AddressSanitizer reports a read of freed mutex data and a write when the worker unlocks the freed tokio::sync::Mutex on the pool thread. No unsafe is required at the call site, and the affected methods include count, keys/keysr, scan/scanr, compact, shutdown, point reads and writes, and cursor iteration.
3.3.0 upgrades to affinitypool 0.8.0, where spawn_local is an unsafe function and the caller must uphold the leak-freedom invariant (commit 8156ff69).
Advisory available under CC0-1.0
license.