Critical Double Free Vulnerability in Rust Package - CVE-2021-31162
Summary
ALPINE-CVE-2021-31162: In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics. Affects rust versions < 1.51.0-r2. Fixed in 1.51.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rust is a systems programming language focused on safety and performance, particularly in concurrent programming. It provides memory safety without using garbage collection, making it a popular choice for developing reliable and efficient software. However, prior to version 1.52.0, Rust's standard library contained a vulnerability in the Vec::from_iter function, which could lead to a double free error under certain conditions.
Vulnerability Detail
The vulnerability identified as CVE-2021-31162 is a double free issue that occurs in the Rust standard library before version 1.52.0. This flaw arises when freeing an element in the Vec::from_iter function panics, potentially leading to memory corruption and application crashes. The ramifications of this vulnerability can be severe, as it may allow attackers to exploit the memory management system, leading to arbitrary code execution or denial of service.
How To Fix
Minimum fixed version
1.51.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade rustTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the Vec::from_iter function until the package is updated. Alternatively, consider using other data structures or methods that do not trigger this vulnerability.
Conclusion
CVE-2021-31162 represents a significant vulnerability in the Rust programming language's standard library, specifically affecting the Vec::from_iter function. Users are strongly advised to update to the patched version to mitigate risks associated with this flaw. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for rust →
FAQ
CVE-2021-31162 is a vulnerability in the Rust programming language's standard library that can lead to a double free error in the Vec::from_iter function.
The vulnerability can cause memory corruption, application crashes, and may allow attackers to execute arbitrary code or cause denial of service.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If an immediate update is not possible, avoid using the Vec::from_iter function and consider alternative data structures until the issue is resolved.
The CVSS score for CVE-2021-31162 is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for rust.
