CVE-2023-48184: 
NixOS vulnerability analysis and mitigation

CVE-2023-48184 affects QuickJS before commit 7414e5f, where a use-after-free vulnerability exists in the JS_FreeValueRT function in quickjs.h due to incorrect garbage collection of async functions with closures (NVD). The vulnerability was discovered and disclosed in April 2024.

The vulnerability stems from a heap-use-after-free issue occurring in quickjs.h line 657 within the JS_FreeValueRT function. The issue arises specifically during the garbage collection process when handling async functions that contain closures. According to the CVSS 3.1 scoring by CISA-ADP, this vulnerability has a base score of 3.9 (LOW) with the vector string CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L (NVD).

The vulnerability can lead to memory corruption through use-after-free conditions, potentially resulting in program crashes or possible code execution. The CVSS scoring indicates low impacts on confidentiality, integrity, and availability (NVD).

The vulnerability requires high privileges and complex attack conditions to exploit, as indicated by the CVSS metrics. A proof-of-concept exists demonstrating the issue through a specific code pattern involving nested async functions and promises (GitHub Issue).

The vulnerability has been fixed in QuickJS commit 7414e5f. Users should update to this version or later to mitigate the issue (NVD).