Cloudanix VulnDB

CVE-2021-46348

Medium · 5.5

CVSS

5.5

EPSS

0.6%

Published

Jan 20, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a small JavaScript engine used inside other programs lets an attacker crash those programs by giving them specially crafted code to run.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability triggers an assertion failure 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' in the ECMA literal storage module of the JerryScript engine, causing an immediate process abort and denial of service.

Why it matters to the business

Applications or devices embedding the vulnerable JerryScript engine can be crashed on demand, interrupting services, automation workflows, or embedded JavaScript execution with no data integrity impact but clear availability loss.

How an attack unfolds

An attacker supplies a crafted JavaScript payload that reaches the literal storage path with an unexpected reference count; when JerryScript processes the input the failing assertion aborts the engine. Public exploit code exists and the issue has been known for years.

How to fix it

Upgrade JerryScript to a patched release that removes or guards the assertion in ecma-literal-storage.c; where an upgrade path is unavailable, isolate or sandbox the engine and reject untrusted JavaScript inputs.

How to confirm the fix worked

Reproduce the original crashing input in a controlled environment and confirm the process no longer aborts; inspect binaries or source for the presence of the literal-storage assertion and verify updated builds pass regression tests.

Typical attack path

  1. Locate a target process or device that embeds the vulnerable JerryScript version
  2. Craft or obtain a minimal JavaScript input that violates the single-reference assumption in literal storage
  3. Deliver the input through any interface the application uses to ingest JavaScript (file, network, API)
  4. Trigger execution or parsing so the assertion is evaluated and the process terminates

How to detect it

Search application and system logs for abrupt terminations accompanied by the literal-storage assertion message or core dumps originating from jerry-core/ecma/base/ecma-literal-storage.c.

What your security team should do

  • Inventory all deployments that embed JerryScript 3.0.0 or earlier
  • Apply the latest JerryScript release or back-port the literal-storage fix
  • Add runtime sandboxing and input-size limits around JavaScript execution
  • Configure process monitoring to alert on unexpected JerryScript terminations

The record

There is an Assertion 'ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_p)' failed at /jerry-core/ecma/base/ecma-literal-storage.c in JerryScript 3.0.0.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS iotjs 0 No fix
Ubuntu:22.04:LTS iotjs 0 No fix
Ubuntu:Pro:18.04:LTS iotjs 0 No fix
conan jerryscript 3.0.0 No fix

Related vulnerabilities