CVE-2021-42612

What it actually does

Use-after-free condition in cleanup_index during index processing of crafted documents leads to memory corruption that can result in segmentation faults or broader unspecified memory safety violations.

Why it matters to the business

Processing of untrusted documents on affected systems can trigger crashes or allow arbitrary code execution, disrupting document workflows and potentially compromising workstations or build environments that rely on Halibut.

How an attack unfolds

An attacker supplies a specially crafted text document to Halibut; during index cleanup the freed memory is reused, and with an available public exploit the attacker can trigger the flaw to achieve memory corruption and subsequent code execution or denial of service.

How to fix it

Upgrade Halibut to a version containing the fix for the use-after-free in cleanup_index; rebuild and redeploy any Fedora packages or downstream tooling that embeds the vulnerable Halibut binary; remove or sandbox legacy 1.2 installations until patches are applied.

How to confirm the fix worked

Confirm Halibut version is newer than 1.2 and that index.c no longer contains the vulnerable cleanup_index logic; run regression tests with known triggering documents; monitor for absence of segmentation faults on previously crashing inputs.

Typical attack path

1. Obtain or generate a malicious text document targeting the index.c cleanup path
2. Invoke Halibut on the crafted document locally or via automated build tooling
3. Trigger use-after-free during index cleanup to corrupt memory
4. Leverage corruption for control-flow hijacking or crash depending on exploit primitive

How to detect it

Review process execution logs and application crash reports for Halibut invocations on untrusted documents; inspect core dumps or segmentation fault records that originate from index.c cleanup paths; correlate file-processing timestamps with anomalous Halibut terminations.

What your security team should do

• Prioritize patching or replacing all Halibut 1.2 instances given public exploit availability
• Inventory document-processing pipelines and CI systems that invoke Halibut
• Apply vendor updates for Fedora packages once released and verify deployed binaries
• Restrict Halibut execution to trusted input sources until remediation is complete