Critical NULL Pointer Dereference in QuickJS Package
Summary
DEBIAN-CVE-2023-48183: QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval. Affects quickjs versions < 2024.01.13-1. Fixed in 2024.01.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QuickJS is a lightweight JavaScript engine that is designed for embedding in applications. It supports modern JavaScript features and is known for its small footprint and fast execution. However, a recent vulnerability has been identified that affects its stability and security, specifically related to the handling of lexical scopes in the eval function.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2023-48183, arises from a NULL pointer dereference in the build_for_in_iterator function of QuickJS. This issue is caused by an erroneous lexical scope of 'this' when using the eval function. If exploited, this vulnerability can lead to application crashes or unexpected behavior, potentially allowing an attacker to disrupt the normal operation of applications relying on QuickJS.
How To Fix
Minimum fixed version
2024.01.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade quickjsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the eval function in contexts where the lexical scope of 'this' may lead to instability. Review your code to ensure that any use of eval is necessary and safe.
Conclusion
The QuickJS package has a critical vulnerability that can lead to application instability due to a NULL pointer dereference. It is essential to update to the patched version to mitigate risks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for quickjs →
FAQ
The vulnerability is a NULL pointer dereference caused by an erroneous lexical scope of 'this' in the eval function, which can lead to application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can result in application crashes or unexpected behavior, impacting the stability of applications that utilize QuickJS.
Yes, a patched version of QuickJS is available. Update to version 2024.01.13-1 to resolve the issue.
If immediate updating is not possible, consider avoiding the use of eval in your code until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for quickjs.
