Cloudanix VulnDB

CVE-2021-46342

Medium · 5.5

CVSS

5.5

EPSS

0.6%

Published

Jan 20, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a JavaScript engine can make programs using it crash when they receive certain unusual input, causing temporary service interruptions.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failed assertion in ecma-helpers.c triggers a crash when processing certain JavaScript objects that violate expected lexical environment or fast-array invariants.

Why it matters to the business

Local denial-of-service that can interrupt any application or service relying on the affected JavaScript engine, with low likelihood of data loss but potential for repeated service restarts.

How an attack unfolds

An attacker supplies a specially crafted JavaScript snippet or object literal that reaches the assertion check inside the ECMA helper routines; the assertion fails and the process terminates. Public exploit code exists but requires local execution or user interaction to load the malicious script.

How to fix it

No fixed versions are listed; apply vendor or community patches if later released, or rebuild with the assertion converted to a graceful error return. Restrict untrusted script execution and validate input objects before passing them to the engine.

How to confirm the fix worked

Reproduce the original assertion failure with the known triggering script; confirm the process no longer crashes or that the assertion is removed after applying any patch or workaround.

Typical attack path

  1. Identify an application or service that embeds JerryScript and accepts untrusted JavaScript input.
  2. Craft a minimal JavaScript payload that violates the lexical-environment or fast-array assumption.
  3. Deliver the payload via local file, command-line argument, or UI-triggered script load.
  4. Trigger script execution to reach the failing assertion and crash the process.

How to detect it

Review application or system logs for segmentation faults, abort signals, or the exact assertion string from ecma-helpers.c around the time of unexpected process exits. Correlate with recent file or script loads if user interaction is required.

What your security team should do

  • Treat as local DoS and prioritize only if the engine runs untrusted scripts from users.
  • Disable or sandbox JerryScript usage where possible until a fix appears.
  • Monitor for new upstream releases and test them promptly.
  • Add runtime monitoring for unexpected process terminations in services using the engine.

The record

There is an Assertion 'ecma_is_lexical_environment (obj_p) || !ecma_op_object_is_fast_array (obj_p)' failed at /jerry-core/ecma/base/ecma-helpers.c in JerryScript 3.0.0.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS iotjs 0 No fix
Ubuntu:22.04:LTS iotjs 0 No fix
Ubuntu:Pro:18.04:LTS iotjs 0 No fix
conan jerryscript 3.0.0 No fix

Related vulnerabilities