PT-2021-19594 · Rkyv · Rkyv

Published 2021-04-28 · Updated 2022-07-12 · CVE-2021-31919

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: rkyv versions prior to 0.6.0

Description: The issue concerns the rkyv crate, a serialization framework for Rust, where archives created via serialization may contain uninitialized values of certain struct parts. This occurs because during serialization, struct padding bytes and unused enum bytes may not be initialized, potentially leading to these bytes being written to disk or sent over unsecured channels.

Recommendations: For versions prior to 0.6.0, update to version 0.6.0 or later to resolve the issue.

Fix

Use of Uninitialized Resource

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-909

CWE-908

CWE-772

Related Identifiers

CVE-2021-31919

GHSA-W5CR-FRPH-HW7F

RUSTSEC-2021-0054

Affected Products

Rkyv

References · 9

• https://osv.dev/vulnerability/RUSTSEC-2021-0054 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w5cr-frph-hw7f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31919 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31919 · Security Note
• https://github.com/djkoloski/rkyv/commit/f141b560523a20557db6540576d153010bd18712 · Note
• https://github.com/djkoloski/rkyv/commit/9c65ae9c2c67dd949b5c3aba9b8eba6da802ab7e · Note
• https://github.com/djkoloski/rkyv/issues/113 · Note
• https://crates.io/crates/rkyv · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0054.html · Note