PT-2021-17972 · Rust+6 · Rust+6

Qwazo · Published 2021-04-11 · Updated 2022-11-03 · CVE-2021-28876

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Rust versions prior to 1.52.0

Description: The issue is related to a panic safety problem in the Zip implementation of the Rust standard library. It occurs when the underlying iterator panics under certain conditions, causing iterator get unchecked() to be called more than once for the same index. This can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

Recommendations: For versions prior to 1.52.0, update to version 1.52.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Zip implementation in the standard library until a patch is available.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

ALT-PU-2021-1761

ALT-PU-2021-1775

ALT-PU-2021-3365

ALT-PU-2022-1778

CESA-2021_3063

CVE-2021-28876

MGASA-2021-0251

OESA-2021-1214

RHSA-2021:3042

RHSA-2021:3063

RHSA-2021_3063

RLSA-2021:3063

Affected Products

Alt Linux

Astra Linux

Centos

Debian

Red Hat

Rocky Linux

Rust

References · 43

• 🔥 https://github.com/rust-lang/rust/issues/81740 · Exploit
• https://github.com/rust-lang/rust/pull/81741 · Patch
• https://cve.org/CVERecord?id=CVE-2021-28876 · Security Note
• https://ubuntu.com/security/CVE-2021-28876 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-3063.html · Vendor Advisory
• https://security.gentoo.org/glsa/202210-09 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-28876 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28876 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-28876 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36318 · Security Note
• https://osv.dev/vulnerability/RLSA-2021:3063 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-28876 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28877 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0251.html · Security Note