Standard Library up to 1.50.x on Rust __iterator_get_unchecked memory corruption

Summaryinfo

A vulnerability, which was classified as critical, was found in Standard Library up to 1.50.x on Rust. This issue affects the function __iterator_get_unchecked. Such manipulation leads to memory corruption. This vulnerability is listed as CVE-2021-28877. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Standard Library up to 1.50.x on Rust (Software Library). Affected by this issue is the function __iterator_get_unchecked. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability.

The weakness was presented 04/12/2021. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2021-28877. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 236569 (Alibaba Cloud Linux 3 : 0061: rust-toolset:rhel8 (ALINUX3-SA-2021:0061)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.51.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (236569). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Software Library

Name

• Standard Library

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47
• 1.48
• 1.49
• 1.50

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion