Unratedcrates.ioPublished
Use-after-free of caller-owned server name in client connection constructors
GHSA-rc3f-4j82-cmrg
- Affected
- crates.io rustls-ffi >= 0.12.0, < 0.15.7
- Fixed in
- 0.15.7· Vendor fix available
- Issue
- In rustls-ffi 0.12.0 through 0.15.6, `rustls_client_connection_new()` and `rustls_client_connection_new_alpn()` retained a reference to the caller's `server_name` buffer after returning, rather than copying it. The API documentation did not require the buffer to outlive the call and as a result if the caller freed or reused the buffer, later TLS processing read freed memory. Clients that free or reuse the `server_name` buffer after the constructor returns are affected. This is most likely for language bindings that pass temporary strings. Callers that keep the `server_name` buffer alive for the lifetime of the `rustls_client_config` are not affected. Versions 0.12.0 through 0.15.6 are affected. Version 0.15.7+ changed these APIs to copy the input buffer.
Recommended action: Upgrade to 0.15.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.