PT-2021-24259 · Unknown · Columnar Crate

Published 2021-01-07 · Updated 2022-06-16 · CVE-2021-45685

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: columnar crate versions through 2021-01-07

Description: The issue allows arbitrary Read implementations to read from an uninitialized buffer passed by ColumnarReadExt::read typed vec(), leading to memory exposure. This can also result in incorrect byte counts being returned to the buffer. Reading from uninitialized memory can produce undefined values, potentially invoking undefined behavior.

Recommendations: For versions of the columnar crate through 2021-01-07, consider disabling the ColumnarReadExt::read typed vec() function until a patch is available to prevent arbitrary Read implementations from accessing uninitialized memory. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2021-45685

GHSA-9MP7-45QH-R8J8

GHSA-CXCC-Q839-2CW9

RUSTSEC-2021-0087

Affected Products

Columnar Crate

References · 11

• https://osv.dev/vulnerability/CVE-2021-45685 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0087 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45685 · Security Note
• https://osv.dev/vulnerability/GHSA-cxcc-q839-2cw9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9mp7-45qh-r8j8 · Vendor Advisory
• https://github.com/frankmcsherry/columnar/issues/6 · Note
• https://github.com/frankmcsherry/columnar · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/columnar/RUSTSEC-2021-0087.md · Note
• https://crates.io/crates/columnar · Note
• ❌ https://github.com/frankmcsherry/columnar.git · Note, Deleted
• https://rustsec.org/advisories/RUSTSEC-2021-0087.html · Note