PT-2021-16992 · Crates.Io · Cdr

Published 2021-01-02 · Updated 2021-08-25 · CVE-2021-26305

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cdr crate versions prior to 0.2.4

Description An issue was discovered in Deserializer::read vec in the cdr crate for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness. The Deserializer::read vec() function created an uninitialized buffer and passed it to a user-provided Read implementation, which is defined as undefined behavior in Rust.

Recommendations For versions prior to 0.2.4, update to version 0.2.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Deserializer::read vec() until a patch is available. Restrict access to the Read implementation to minimize the risk of exploitation.

Exploit

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2021-26305

GHSA-37JJ-WP7G-7WJ4

RUSTSEC-2021-0012

Affected Products

Cdr

References · 12

• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0012.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-26305 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26305 · Security Note
• https://osv.dev/vulnerability/GHSA-37jj-wp7g-7wj4 · Vendor Advisory
• https://github.com/hrektts/cdr-rs/issues/10 · Note
• https://github.com/hrektts/cdr-rs/pull/11 · Note
• https://github.com/hrektts/cdr-rs · Note
• https://github.com/hrektts/cdr-rs/commit/0e6006de464caa331643f86cd2d9ba3b32b09833 · Note
• https://t.me/cibsecurity/22825 · Telegram Post
• https://t.me/cvenotify/9103 · Telegram Post
• https://crates.io/crates/cdr · Note