PT-2021-24261 · Raw-Cpuid · Raw-Cpuid

Published 2021-01-20 · Updated 2023-08-08 · CVE-2021-45687

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: raw-cpuid crate versions prior to 9.1.1

Description: The issue arises when the non-default serialize feature is activated, allowing most structs to implement serde::Deserialize without sufficient validation. This can lead to breaking invariants in safe code, resulting in undefined behavior in as string() methods, which use std::str::from utf8 unchecked() internally, and panics due to failed assertions.

Recommendations: For versions prior to 9.1.1, update to version 9.1.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the serialize feature until a patch is available. Restrict access to the serde::Deserialize implementation to minimize the risk of exploitation. Avoid using the as string() methods in the affected structs until the issue is resolved.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-20

CWE-502

Related Identifiers

CVE-2021-45687

GHSA-JF5H-CF95-W759

GHSA-W428-F65R-H4Q2

RUSTSEC-2021-0089

Affected Products

Raw-Cpuid

References · 11

• https://osv.dev/vulnerability/GHSA-w428-f65r-h4q2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45687 · Security Note
• https://osv.dev/vulnerability/GHSA-jf5h-cf95-w759 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45687 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0089 · Vendor Advisory
• https://github.com/gz/rust-cpuid · Note
• https://github.com/gz/rust-cpuid/issues/43 · Note
• https://crates.io/crates/raw-cpuid · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/raw-cpuid/RUSTSEC-2021-0089.md · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0089.html · Note
• https://t.me/cvenotify/25045 · Telegram Post