PT-2021-24283 · Crypto2 · Crypto2

Published 2021-10-08 · Updated 2023-08-08 · CVE-2021-45709

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: crypto2 crate through 2021-10-08 for Rust

Description: An issue was discovered in the crypto2 crate that affects Chacha20 encryption and decryption. The implementation does not enforce alignment requirements on input slices, incorrectly assuming 4-byte alignment through an unsafe call to std::slice::from raw parts mut. This breaks the contract and introduces undefined behavior.

Recommendations: For the crypto2 crate through 2021-10-08, consider updating to a version that enforces alignment requirements on input slices to prevent undefined behavior during Chacha20 encryption and decryption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2021-45709

GHSA-9HFG-PXR6-Q4VP

GHSA-PMCV-MGCF-RVXG

RUSTSEC-2021-0121

Affected Products

Crypto2

References · 9

• https://osv.dev/vulnerability/GHSA-pmcv-mgcf-rvxg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45709 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2021-0121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9hfg-pxr6-q4vp · Vendor Advisory
• https://github.com/shadowsocks/crypto2 · Note
• https://github.com/shadowsocks/crypto2/issues/27 · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0121.html · Note
• https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/crypto2/RUSTSEC-2021-0121.md · Note
• https://crates.io/crates/crypto2 · Note