PT-2021-24268 · Rdiff · Rdiff

Published 2021-02-03 · Updated 2022-06-17 · CVE-2021-45694

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: rdiff crate versions through 0.1.2

Description: The issue arises when the rdiff crate uses the return value of a Read instance to set the length of its internal character vector. If the Read implementation claims to have read more bytes than the length of the provided buffer, the length of the vector will be set to longer than its capacity. This causes rdiff APIs to return uninitialized memory in its API methods. The rdiff crate performs a diff of two provided strings or files.

Recommendations: For versions through 0.1.2, as a temporary workaround, consider restricting the use of the rdiff crate until a patch is available. Avoid using the rdiff APIs that return uninitialized memory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2021-45694

GHSA-2RXC-8F9W-FJQ8

GHSA-Q579-9WP9-GFP2

RUSTSEC-2021-0094

Affected Products

Rdiff

References · 10

• https://osv.dev/vulnerability/CVE-2021-45694 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q579-9wp9-gfp2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2rxc-8f9w-fjq8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45694 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2021-0094 · Vendor Advisory
• https://github.com/dyule/rdiff · Note
• https://github.com/dyule/rdiff/issues/3 · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rdiff/RUSTSEC-2021-0094.md · Note
• https://crates.io/crates/rdiff · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0094.html · Note