Vulnerability Description
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used together. This bug could lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rust-Lang | Rust | < 1.52.0 |
| Fedoraproject | Fedora | 32 |
Related Weaknesses (CWE)
References
- https://github.com/rust-lang/rust/issues/82291ExploitIssue TrackingThird Party Advisory
- https://github.com/rust-lang/rust/pull/82292PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202210-09Third Party Advisory
- https://github.com/rust-lang/rust/issues/82291ExploitIssue TrackingThird Party Advisory
- https://github.com/rust-lang/rust/pull/82292PatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202210-09Third Party Advisory
FAQ
What is CVE-2021-28878?
CVE-2021-28878 is a vulnerability with a CVSS score of 7.5 (HIGH). In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are used...
How severe is CVE-2021-28878?
CVE-2021-28878 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-28878?
Check the references section above for vendor advisories and patch information. Affected products include: Rust-Lang Rust, Fedoraproject Fedora.