PT-2021-16836 · Crates.Io · Bra

Published 2021-01-02 · Updated 2022-05-03 · CVE-2021-25905

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions bra crate versions prior to 0.1.1

Description The issue is related to the bra crate for Rust, which provides easy random memory access to a sequential source of data. It lacks soundness because it can read uninitialized memory. This is unsound, as it allows safe Rust code to exhibit undefined behavior. The flaw is due to the creation of an uninitialized buffer, which is then passed to a user-provided Read implementation. This can lead to reading from uninitialized memory.

Recommendations For versions prior to 0.1.1, update to version 0.1.1 or later, which corrects the flaw by zero-initializing newly allocated buffers before handing them to user-provided Read implementations. As a temporary workaround, consider avoiding the use of the bra crate until the issue is resolved.

Exploit

Fix

Out of bounds Read

Use of Uninitialized Resource

Weakness Enumeration

CWE-125

CWE-908

Related Identifiers

CVE-2021-25905

GHSA-J8QQ-58CR-8CC7

RUSTSEC-2021-0008

Affected Products

Bra

References · 10

• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0008.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-25905 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25905 · Security Note
• https://osv.dev/vulnerability/GHSA-j8qq-58cr-8cc7 · Vendor Advisory
• https://github.com/Enet4/bra-rs · Note
• https://github.com/Enet4/bra-rs/commit/aabf5562f8c6374ab30f615b28e0cff9b5c79e5f · Note
• https://github.com/Enet4/bra-rs/issues/1 · Note
• https://t.me/cvenotify/9265 · Telegram Post
• https://crates.io/crates/bra · Note