CVE-2021-26306 Soundness issue in raw-cpuid
Unsound transmute calls in the raw-cpuid crate allow attackers to trigger memory corruption, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26306?
CVE-2021-26306 is a high-severity memory corruption vulnerability in n/a, published on 29 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It has unsound transmute calls within as_string() methods.
Which versions are affected by CVE-2021-26306?
2 open source packages ship an affected version, including raw-cpuid. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
raw-cpuid crates.io | All versions | 9.0.0 |
raw-cpuid crates.io | All versions | 9.0.0 |
Products include Raw-Cpuid Project Raw-Cpuid.
How do I fix CVE-2021-26306?
Upgrade raw-cpuid to 9.0.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-26306 being exploited?
There is no known exploitation of CVE-2021-26306 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hvqc-pc78-x9wh.