PT-2021-17719 · Unknown · Scratchpad

Published 2021-02-18 · Updated 2022-05-24 · CVE-2021-28031

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: scratchpad versions prior to 1.3.1

Description: An issue was discovered in the scratchpad crate for Rust. The move elements function can have a double-free upon a panic in a user-provided f function. This occurs because affected versions of scratchpad used ptr::read to read elements while calling a user-provided function f on them, duplicating ownership. If a panic happens inside the user-provided f function, it could cause a double free when unwinding.

Recommendations: For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the move elements function with user-provided functions that may panic, until a patch is applied.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2021-28031

GHSA-3QM2-RFQW-FMRW

RUSTSEC-2021-0030

Affected Products

Scratchpad

References · 11

• https://osv.dev/vulnerability/CVE-2021-28031 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3qm2-rfqw-fmrw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28031 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2021-0030 · Vendor Advisory
• https://rustsec.org/advisories/RUSTSEC-2021-0030.html · Patch
• https://github.com/okready/scratchpad/commit/891561bea · Note
• https://github.com/okready/scratchpad/issues/1 · Note
• https://github.com/okready/scratchpad · Note
• https://crates.io/crates/scratchpad · Note
• https://t.me/cvenotify/10958 · Telegram Post
• https://t.me/cibsecurity/24500 · Telegram Post