PT-2021-18734 · Id-Map · Id-Map
Published
2021-02-26
·
Updated
2021-08-25
·
CVE-2021-30457
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
id-map crate through 2021-02-26 for Rust
Description
A double free issue can occur in the id-map crate due to panic in Drop impl. Specifically, this issue affects the
IdMap::clone from, get or insert, and remove set functions. In clone from, if a .clone() call panics, previously dropped elements can be freed again. In get or insert, if the user-provided insertion function f panics, uninitialized or previously freed memory can be dropped. In remove set, if the Drop impl of an element panics, previously dropped elements can be dropped again.Recommendations
For the id-map crate through 2021-02-26, consider avoiding the use of
IdMap::clone from, get or insert, and remove set functions until a patch is available. As a temporary workaround, consider implementing custom error handling to prevent panics in the Drop impl and user-provided insertion functions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Id-Map