Nanorand · Nanorand · CVE-2021-45705
Name of the Vulnerable Software and Affected Versions:
nanorand crate versions prior to 0.6.1
Description:
The issue arises from the `TlsWyRand` implementation of `Deref`, which unconditionally dereferences a raw pointer and returns multiple mutable references to the same object. This behavior is undefined and can lead to unpredictable outcomes.
Recommendations:
For versions prior to 0.6.1, update to version 0.6.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of `TlsWyRand` to minimize the risk of exploitation.