CVE-2024-38375 (published 2024-06-26T19:15Z)

@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the `@fastly/js-compute` package.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/fastly/js-compute-runtime
commit_details: repo_url: https://github.com/fastly/js-compute-runtime
author: Trevor Elliott
author_date: 2024-06-20 20:12:33-07:00
msg: fix: Fix uses of cabi_realloc that were discarding their results (#811)

Fix issues in some host calls where a buffer length error was being handled by reallocating to the new buffer size, but was discarding the new buffer's pointer. This should also fix flaky tests in CI.
repository: repo_url: https://github.com/fastly/js-compute-runtime
repo_name: fastly/js-compute-runtime
description: JavaScript SDK and runtime for building Fastly Compute applications
repo_language: C++
owner: fastly
file_changes: filename: fastly_world_adapter.cpp
change_type: ModificationType.MODIFY
diff: @@ -210,7 +210,7 @@ bool fastly_compute_at_edge_http_req_downstream_tls_cipher_openssl_name(
   auto status = fastly::req_downstream_tls_cipher_openssl_name(reinterpret_cast<char *>(ret->ptr),
                                                                default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::req_downstream_tls_cipher_openssl_name(reinterpret_cast<char *>(ret->ptr),
                                                             ret->len, &ret->len);
   }
@@ -224,7 +224,7 @@ bool fastly_compute_at_edge_http_req_downstream_tls_protocol(
   auto status = fastly::req_downstream_tls_protocol(reinterpret_cast<char *>(ret->ptr),
                                                     default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::req_downstream_tls_protocol(reinterpret_cast<char *>(ret->ptr), ret->len,
                                                  &ret->len);
   }
@@ -238,7 +238,7 @@ bool fastly_compute_at_edge_http_req_downstream_tls_raw_client_certificate(
   auto status =
       fastly::req_downstream_tls_raw_client_certificate(ret->ptr, default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::req_downstream_tls_raw_client_certificate(ret->ptr, ret->len, &ret->len);
   }
   return convert_result(status, err);
@@ -250,7 +250,7 @@ bool fastly_compute_at_edge_http_req_downstream_tls_ja3_md5(
   ret->ptr = static_cast<uint8_t *>(cabi_malloc(default_size, 4));
   auto status = fastly::req_downstream_tls_ja3_md5(ret->ptr, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::req_downstream_tls_ja3_md5(ret->ptr, &ret->len);
   }
   return convert_result(status, err);
@@ -261,7 +261,7 @@ bool fastly_compute_at_edge_http_req_downstream_tls_client_hello(
   ret->ptr = static_cast<uint8_t *>(cabi_malloc(default_size, 4));
   auto status = fastly::req_downstream_tls_client_hello(ret->ptr, default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::req_downstream_tls_client_hello(ret->ptr, ret->len, &ret->len);
   }
   return convert_result(status, err);
@@ -1243,7 +1243,7 @@ bool fastly_compute_at_edge_cache_get_user_metadata(fastly_compute_at_edge_cache
   auto status = fastly::cache_get_user_metadata(handle, reinterpret_cast<char *>(ret->ptr),
                                                 default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::cache_get_user_metadata(handle, reinterpret_cast<char *>(ret->ptr), ret->len,
                                              &ret->len);
   }
@@ -1387,10 +1387,10 @@ bool fastly_compute_at_edge_device_detection_lookup(
       fastly::device_detection_lookup(reinterpret_cast<char *>(user_agent->ptr), user_agent->len,
                                       reinterpret_cast<char *>(ret->ptr), default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status =
         fastly::device_detection_lookup(reinterpret_cast<char *>(user_agent->ptr), user_agent->len,
                                         reinterpret_cast<char *>(ret->ptr), ret->len, &ret->len);
   }
   return convert_result(status, err);
-}
\ No newline at end of file
+}

programming_language: C++
filename: fastly_world_adapter.cpp
change_type: ModificationType.MODIFY
diff: @@ -210,7 +210,7 @@ bool fastly_compute_at_edge_http_req_downstream_tls_cipher_openssl_name(
   auto status = fastly::req_downstream_tls_cipher_openssl_name(reinterpret_cast<char *>(ret->ptr),
                                                                default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::req_downstream_tls_cipher_openssl_name(reinterpret_cast<char *>(ret->ptr),
                                                             ret->len, &ret->len);
   }
@@ -224,7 +224,7 @@ bool fastly_compute_at_edge_http_req_downstream_tls_protocol(
   auto status = fastly::req_downstream_tls_protocol(reinterpret_cast<char *>(ret->ptr),
                                                     default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::req_downstream_tls_protocol(reinterpret_cast<char *>(ret->ptr), ret->len,
                                                  &ret->len);
   }
@@ -238,7 +238,7 @@ bool fastly_compute_at_edge_http_req_downstream_tls_raw_client_certificate(
   auto status =
       fastly::req_downstream_tls_raw_client_certificate(ret->ptr, default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::req_downstream_tls_raw_client_certificate(ret->ptr, ret->len, &ret->len);
   }
   return convert_result(status, err);
@@ -250,7 +250,7 @@ bool fastly_compute_at_edge_http_req_downstream_tls_ja3_md5(
   ret->ptr = static_cast<uint8_t *>(cabi_malloc(default_size, 4));
   auto status = fastly::req_downstream_tls_ja3_md5(ret->ptr, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::req_downstream_tls_ja3_md5(ret->ptr, &ret->len);
   }
   return convert_result(status, err);
@@ -261,7 +261,7 @@ bool fastly_compute_at_edge_http_req_downstream_tls_client_hello(
   ret->ptr = static_cast<uint8_t *>(cabi_malloc(default_size, 4));
   auto status = fastly::req_downstream_tls_client_hello(ret->ptr, default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::req_downstream_tls_client_hello(ret->ptr, ret->len, &ret->len);
   }
   return convert_result(status, err);
@@ -1243,7 +1243,7 @@ bool fastly_compute_at_edge_cache_get_user_metadata(fastly_compute_at_edge_cache
   auto status = fastly::cache_get_user_metadata(handle, reinterpret_cast<char *>(ret->ptr),
                                                 default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status = fastly::cache_get_user_metadata(handle, reinterpret_cast<char *>(ret->ptr), ret->len,
                                              &ret->len);
   }
@@ -1387,10 +1387,10 @@ bool fastly_compute_at_edge_device_detection_lookup(
       fastly::device_detection_lookup(reinterpret_cast<char *>(user_agent->ptr), user_agent->len,
                                       reinterpret_cast<char *>(ret->ptr), default_size, &ret->len);
   if (status == FASTLY_COMPUTE_AT_EDGE_TYPES_ERROR_BUFFER_LEN) {
-    cabi_realloc(ret->ptr, default_size, 4, ret->len);
+    ret->ptr = static_cast<uint8_t *>(cabi_realloc(ret->ptr, default_size, 4, ret->len));
     status =
         fastly::device_detection_lookup(reinterpret_cast<char *>(user_agent->ptr), user_agent->len,
                                         reinterpret_cast<char *>(ret->ptr), ret->len, &ret->len);
   }
   return convert_result(status, err);
-}
\ No newline at end of file
+}

programming_language: C++