PT-2021-19197 · Rust+6 · Rust+6

Cuviper · Published 2021-04-14 · Updated 2022-11-03 · CVE-2021-31162

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rust versions prior to 1.52.0

Description A double free can occur in the Vec::from iter function if freeing the element panics. This issue is related to the standard library in Rust.

Recommendations For versions prior to 1.52.0, update to version 1.52.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Vec::from iter function in scenarios where freeing elements might panic, until a patch is applied.

Exploit

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2021-1761

ALT-PU-2021-1775

ALT-PU-2021-3365

ALT-PU-2022-1778

CESA-2021_3063

CVE-2021-31162

MGASA-2021-0251

RHSA-2021:3042

RHSA-2021:3063

RHSA-2021_3063

RLSA-2021:3063

Affected Products

Alt Linux

Astra Linux

Centos

Debian

Red Hat

Rocky Linux

Rust

References · 40

• 🔥 https://github.com/rust-lang/rust/issues/83618 · Exploit
• https://github.com/rust-lang/rust/pull/83629 · Patch
• https://github.com/rust-lang/rust/pull/84603 · Patch
• https://ubuntu.com/security/CVE-2021-31162 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-3063.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31162 · Security Note
• https://security.gentoo.org/glsa/202210-09 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-31162 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-31162 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:3063 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31162 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0251.html · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0251 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:3063 · Vendor Advisory