CVE-2024-22956: 
NixOS vulnerability analysis and mitigation

SWFTools version 0.9.2 contains a heap-use-after-free vulnerability in the function removeFromTo located at swftools/src/swfc.c:838. The vulnerability was discovered and disclosed on December 28, 2023 (GitHub Issue).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is classified as CWE-416 (Use After Free) and affects the memory management in the removeFromTo function. The vulnerability occurs when attempting to access memory that has been previously freed, specifically at address 0x606000000528, which is located 40 bytes inside a 56-byte freed region (GitHub Issue).

The heap-use-after-free vulnerability could potentially lead to program crashes, memory corruption, and possible code execution. Given the CVSS score and vector string, the vulnerability has high potential impact on confidentiality, integrity, and availability when successfully exploited (NVD).

The vulnerability requires local access and user interaction to exploit. A proof of concept (PoC) has been published demonstrating the issue on Ubuntu 18.04 TLS. The vulnerability can be triggered through the swfc command-line tool when processing specially crafted input (GitHub Issue).