PT-2021-24278 · Unknown · Metrics-Util

Published 2021-04-07 · Updated 2022-06-17 · CVE-2021-45704

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: metrics-util crate versions prior to 0.7.0

Description: The issue is related to a data race and memory corruption in the AtomicBucket<T> implementation. This occurs because AtomicBucket<T> unconditionally implements the Send and Sync traits, allowing users to create a data race to the inner T: !Sync by using the AtomicBucket::data with() API. Such data races can potentially cause memory corruption or other undefined behavior.

Recommendations: For versions prior to 0.7.0, update to version 0.7.0 or later to fix the issue by adding appropriate Send/Sync bounds to the Send/Sync impl of struct Block<T>. As a temporary workaround, consider avoiding the use of the AtomicBucket::data with() API to minimize the risk of exploitation.

Fix

Race Condition

Memory Corruption

Weakness Enumeration

CWE-362

CWE-787

Related Identifiers

CVE-2021-45704

GHSA-3HXH-7JXM-59X4

GHSA-CWVC-87XQ-PC5M

RUSTSEC-2021-0113

Affected Products

Metrics-Util

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2021-45704 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45704 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0113 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3hxh-7jxm-59x4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cwvc-87xq-pc5m · Vendor Advisory
• https://github.com/metrics-rs/metrics/commit/8e6daab · Note
• https://github.com/metrics-rs/metrics · Note
• https://github.com/metrics-rs/metrics/issues/190 · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0113.html · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/metrics-util/RUSTSEC-2021-0113.md · Note
• https://crates.io/crates/metrics-util · Note