CVE-2021-36088 — Double Free in Fluent BIT

CWE-415 — Double Free3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.5%
top 33.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Treasuredata Fluent BIT
Timeline
PublishedJul 1
Latest updateMar 20

Description

Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDtreasuredata/fluent_bit1.7.0 — 1.7.4

Patches

Patch: bugs.chromium.org ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-89w3-2j93-4g79: Fluent Bit (aka fluent-bit) 1↗2022-05-24
▶

📄Research Papers

1
arXiv
Fat Pointers for Temporal Memory Safety of C↗2023-03-20
▶
CVE-2021-36088 — Double Free in Treasuredata Fluent BIT | cvebase