CVE-2021-25906 Double free in basic_dsp_matrix
A double drop vulnerability in the basic_dsp_matrix crate can cause a panic and denial of service when TransformContent fails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-25906?
CVE-2021-25906 is a high-severity use after free vulnerability in n/a, published on 22 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
Which versions are affected by CVE-2021-25906?
3 open source packages ship an affected version, including basic_dsp_matrix. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
basic_dsp_matrix crates.io | All versions | 0.9.2 |
basic_dsp_matrix crates.io | All versions | 0.9.2 |
basic_dsp_matrix crates.io | From 0.0.0-0 | 0.9.2 |
Products include Basic Dsp Matrix Project Basic Dsp Matrix.
How do I fix CVE-2021-25906?
Upgrade basic_dsp_matrix to 0.9.2 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2021-25906 being exploited?
There is no known exploitation of CVE-2021-25906 in the wild and no public exploit code.
Sources
Also known as GHSA-fjr6-hm39-4cf9, RUSTSEC-2021-0009.