PT-2021-17193 · Ms3D · Ms3D
Published
2021-01-26
·
Updated
2021-08-25
·
CVE-2021-26952
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
ms3d crate versions prior to 0.1.3
Description:
The issue allows attackers to obtain sensitive information from uninitialized memory locations via
IoReader::read. Affected versions of the crate pass an uninitialized buffer to a user-provided Read implementation, which can read from the buffer and return incorrect numbers of bytes written, producing undefined values that can invoke undefined behavior.Recommendations:
For versions prior to 0.1.3, update to version 0.1.3 or later, which includes the fix for the issue by zero-initializing the buffer before passing it to
Read. As a temporary workaround, consider avoiding the use of IoReader::read until the update is applied.Exploit
Fix
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ms3D