PT-2021-16835 · Av-Data · Av-Data

Published 2021-01-07 · Updated 2021-08-25 · CVE-2021-25904

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions av-data crate versions prior to 0.3.0

Description An issue in the av-data crate allows a raw pointer to be dereferenced, leading to a read of an arbitrary memory address. This can sometimes cause a segfault. The fn Frame::copy from raw parts() function is a safe API that can take a raw pointer and dereference it, allowing access to arbitrary memory addresses. Feeding an invalid memory address pointer to the API may also cause the program to segfault.

Recommendations For versions prior to 0.3.0, the issue was corrected by removing the fn Frame::copy from raw parts() function. As a temporary workaround, consider avoiding the use of this function until the issue is resolved. Update to version 0.3.0 or later to fix the issue.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-25904

GHSA-352P-RHVQ-7G78

RUSTSEC-2021-0007

Affected Products

Av-Data

References · 9

• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0007.html · Exploit
• https://osv.dev/vulnerability/RUSTSEC-2021-0007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25904 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25904 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-352p-rhvq-7g78 · Vendor Advisory
• https://github.com/rust-av/rust-av · Note
• https://github.com/rust-av/rust-av/issues/136 · Note
• https://t.me/cibsecurity/22624 · Telegram Post
• https://crates.io/crates/av-data · Note