GHSA-pm86-cc75-q463: SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends
SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawnlocal closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
The exposed population is Rust applications embedding SurrealDB and using affected surrealdb-core KV backends. Exploitation requires application code that can dispatch a transaction-related future, leak it, and then drop the associated transaction.
Are ordinary database users or remote unauthenticated attackers able to trigger this directly?
The available information describes a local attack path requiring low privileges and a Rust embedder capable of leaking a dispatched future, such as through mem::forget. It does not describe a remote or unauthenticated trigger.
What should teams do if they cannot immediately upgrade?
Avoid code paths that leak dispatched futures while they retain borrowed transaction state, including use of mem::forget on those futures. Ensure transaction lifetimes outlive completion or cancellation and cleanup of the dispatched work.
How can we determine whether our application is affected?
Check whether it embeds SurrealDB before 3.3.0, uses surrealdb-core KV backends, and dispatches transaction work through affinitypool::spawn_local. Review Rust code for intentionally leaked futures or ownership patterns that allow a transaction to be dropped before dispatched work is cleaned up.