PT-2021-24280 · Unknown · Zeroize Derive

Published 2021-09-24 · Updated 2022-06-22 · CVE-2021-45706

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: zeroize derive crate versions prior to 1.2

Description: An issue was discovered where dropped memory is not zeroed out for an enum when the #[zeroize(drop)] attribute is used. This results in memory not being zeroed out after dropping it, contrary to the intended behavior. The flaw was corrected in version 1.2, where #[zeroize(drop)] on enums now properly implements the Drop trait.

Recommendations: For versions prior to 1.2, update to version 1.2 or later to ensure that the #[zeroize(drop)] attribute properly implements the Drop trait for enums, thereby zeroing out dropped memory as intended.

Fix

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2021-45706

GHSA-C5HX-W945-J4PQ

RUSTSEC-2021-0115

Affected Products

Zeroize Derive

References · 9

• https://osv.dev/vulnerability/RUSTSEC-2021-0115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45706 · Security Note
• https://osv.dev/vulnerability/GHSA-c5hx-w945-j4pq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45706 · Vendor Advisory
• https://github.com/RustCrypto/utils/tree/master/zeroize/derive · Note
• https://github.com/iqlusioninc/crates/issues/876 · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/zeroize_derive/RUSTSEC-2021-0115.md · Note
• https://crates.io/crates/zeroize_derive · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0115.html · Note