CVE-2021-26307 Error on unsupported architectures in raw-cpuid
A flaw in the raw-cpuid crate causes a deterministic crash when calling CPUID on unsupported processors, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26307?
CVE-2021-26307 is a medium-severity denial of service vulnerability in n/a, published on 29 Jan 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It allows __cpuid_count() calls even if the processor does not support the CPUID instruction, which is unsound and causes a deterministic crash.
Which versions are affected by CVE-2021-26307?
2 open source packages ship an affected version, including raw-cpuid. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
raw-cpuid crates.io | All versions | 9.0.0 |
raw-cpuid crates.io | All versions | 9.0.0 |
Products include Raw-Cpuid Project Raw-Cpuid.
How do I fix CVE-2021-26307?
Upgrade raw-cpuid to 9.0.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-26307 being exploited?
There is no known exploitation of CVE-2021-26307 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jrf8-cmgg-gv2m.