PT-2021-24263 · Gfx-Auxil · Gfx-Auxil

Published 2021-01-07 · Updated 2022-06-16 · CVE-2021-45689

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: gfx-auxil crate through 2021-01-07

Description: The issue allows arbitrary Read implementations to read from an uninitialized buffer, potentially exposing memory and returning incorrect byte counts. This can lead to undefined behavior due to the reading of uninitialized memory locations. The gfx auxil::read spirv function may read from these uninitialized memory locations.

Recommendations: For versions of the gfx-auxil crate through 2021-01-07, consider restricting the use of the gfx auxil::read spirv function and arbitrary Read implementations until a patch is available. Avoid passing uninitialized buffers to user-provided Read implementations to minimize the risk of memory exposure and undefined behavior. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2021-45689

GHSA-28P5-7RG4-8V99

GHSA-FF2R-XPWQ-6WHJ

RUSTSEC-2021-0091

Affected Products

Gfx-Auxil

References · 10

• https://osv.dev/vulnerability/CVE-2021-45689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45689 · Security Note
• https://osv.dev/vulnerability/GHSA-28p5-7rg4-8v99 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ff2r-xpwq-6whj · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0091 · Vendor Advisory
• https://github.com/gfx-rs/gfx/issues/3567 · Note
• https://github.com/gfx-rs/gfx · Note
• https://crates.io/crates/gfx-auxil · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0091.html · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/gfx-auxil/RUSTSEC-2021-0091.md · Note