PT-2021-16839 · Fil-Ocl · Fil-Ocl

Published 2021-01-04 · Updated 2021-08-25 · CVE-2021-25908

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions fil-ocl crate versions prior to 2021-01-04

Description The issue is related to a double free error in the From<EventList> implementation. Affected versions of the crate use ptr::read to read from a container in From<EventList>, and then call a user-specified Into<Event> function. If the user-provided function panics, it can result in a double-free error.

Recommendations For fil-ocl crate versions prior to 2021-01-04, consider updating to a version released after 2021-01-04 to resolve the issue. As a temporary workaround, consider avoiding the use of From<EventList> with user-provided Into<Event> functions that may panic.

Exploit

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2021-25908

GHSA-X3V2-FGR6-3WMM

RUSTSEC-2021-0011

Affected Products

Fil-Ocl

References · 8

• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0011.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25908 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25908 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3v2-fgr6-3wmm · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0011 · Vendor Advisory
• https://github.com/cogciprocate/ocl/issues/194 · Note
• https://github.com/filecoin-project/fil-ocl · Note
• https://crates.io/crates/fil-ocl · Note