CVE-2024-27934
*const c_void / ExternalPointer unsoundness leading to use-after-free
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
*const c_void / ExternalPointer unsoundness leading to use-after-free
| Assigner | GitHub_M |
| Reserved | 2024-02-28 |
| Published | 2024-03-06 |
| Updated | 2024-08-02 |
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, which is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable for both `*const c_void` and `ExternalPointer` implementations. Version 1.40.3 fixes this issue.
| CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
https://github.com/denoland/deno/security/advisories/GHSA-3j27-563v-28wf
