PT-2021-24254 · Vec-Const · Vec-Const

Published 2021-08-14 · Updated 2022-06-17 · CVE-2021-45680

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: vec-const crate versions prior to 2.0.0

Description: The issue arises from attempting to construct a Vec from a pointer to a const slice, leading to memory corruption. The affected versions of the crate claimed to construct a const Vec with nonzero length and capacity, but this is not possible because such a Vec requires a pointer from an allocator. The implementation was later changed to construct a std::borrow::Cow.

Recommendations: For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue. As a temporary workaround, consider avoiding the construction of a const Vec with nonzero length and capacity until the update is applied.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-45680

GHSA-JMWX-R3GQ-QQ3P

GHSA-X76R-966H-5QV9

RUSTSEC-2021-0082

Affected Products

Vec-Const

References · 10

• https://osv.dev/vulnerability/GHSA-x76r-966h-5qv9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45680 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2021-0082 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jmwx-r3gq-qq3p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45680 · Vendor Advisory
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/vec-const/RUSTSEC-2021-0082.md · Note
• ❌ https://github.com/Eolu/vec-const · Note, Deleted
• ❌ https://github.com/Eolu/vec-const/issues/1#issuecomment-898908241 · Note, Deleted
• https://rustsec.org/advisories/RUSTSEC-2021-0082.html · Note
• https://crates.io/crates/vec-const · Note