CVE-2021-25901 Out of bounds read in lazy-init
A missing Send bound in the lazy-init crate allows data races, potentially leading to memory corruption or crashes in Rust applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-25901?
CVE-2021-25901 is a medium-severity vulnerability in n/a, published on 22 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race.
Weakness: CWE-125
Which versions are affected by CVE-2021-25901?
3 open source packages ship an affected version, including lazy-init. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lazy-init crates.io | All versions | 0.4.0 |
lazy-init crates.io | All versions | 0.4.0 |
lazy-init crates.io | From 0.0.0-0 | 0.4.1-0 |
Products include Lazy-Init Project Lazy-Init.
How do I fix CVE-2021-25901?
Upgrade lazy-init to a fixed version for your release line: 0.4.0 or 0.4.1-0.
Is CVE-2021-25901 being exploited?
There is no known exploitation of CVE-2021-25901 in the wild and no public exploit code.
Sources
Also known as GHSA-w47j-hqpf-qw9w, RUSTSEC-2021-0004.