PT-2021-24256 · Unknown · Bronzedb-Protocol
Hexilee
·
Published
2021-01-03
·
Updated
2022-06-16
·
CVE-2021-45682
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
bronzedb-protocol crate versions through 2021-01-03
Description:
An issue in the bronzedb-protocol crate allows ReadKVExt to read from uninitialized memory locations. Affected versions of this crate pass an uninitialized buffer to a user-provided
Read implementation. Arbitrary Read implementations can read from the uninitialized buffer, resulting in memory exposure, and can also return an incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.Recommendations:
For versions through 2021-01-03, consider restricting the use of the
Read implementation to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the Read implementation with uninitialized buffers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bronzedb-Protocol