High · 7.5 CVE-2024-45773 EUVD-2024-41595GHSA-vww8-5r8j-mrcr

A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code executio…

Published Sep 27, 2024 · Updated Sep 27, 2024 · Assigned by facebook

Vendor: Facebook Product: Facebook Thrift Package: thrift Ecosystem: Azure Linux

Description

A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00.

Affected products

Vendor	Product	Affected	Fixed
Facebook	Facebook Thrift	v0.0.0.0 – < v2024.09.09.00	v2024.09.09.00

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	thrift	0.15.0-5	—

References

https://www.facebook.com/security/advisories/cve-2024-45773