Miggo Logo
Miggo Vulnerability Database
→
GHSA-q89g-4vhh-mvvm

GHSA-q89g-4vhh-mvvm: Incorrect Lifetime Bounds on Closures in `rusqlite`

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-q89g-4vhh-mvvm
EPSS Score
-
CWE
-
Published
6/17/2022
Updated
6/13/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
rusqliterust>= 0.26.0, < 0.26.20.26.2
rusqliterust>= 0.25.0, < 0.25.40.25.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from closure parameters accepting 'fn' pointers instead of 'Fn' traits with proper 'static lifetimes. All listed functions register callbacks that SQLite might invoke later, but their pre-patch implementations allowed capturing stack-allocated values. The GHSA example with update_hook demonstrates concrete UAF through Mutex capture, and the advisory explicitly lists all 7 functions across three feature groups as impacted. The high confidence comes from reproducible crashes in user reports and explicit function enumeration in multiple authoritative sources (GHSA, RustSec, and project issues).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** li**tim* *oun* on s*v*r*l *losur*-****ptin* `rusqlit*` *un*tions (sp**i*i**lly, *un*tions w*i** r**ist*r * **ll***k to ** l*t*r invok** *y SQLit*) w*s too r*l*x**. I* * *losur* r***r*n*in* *orrow** v*lu*s on t** st**k is w*s p*ss** to on* o* t**s

Reasoning

T** vuln*r**ility st*ms *rom *losur* p*r*m*t*rs ****ptin* '*n' point*rs inst*** o* '*n' tr*its wit* prop*r 'st*ti* li**tim*s. *ll list** *un*tions r**ist*r **ll***ks t**t SQLit* mi**t invok* l*t*r, *ut t**ir pr*-p*t** impl*m*nt*tions *llow** **pturin