CVE-2021-28036 quinn invalidly assumes the memory layout of std::net::SocketAddr
Invalid memory access in the quinn crate allows attackers to potentially execute code or cause denial of service via crafted network packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28036?
CVE-2021-28036 is a high-severity memory corruption vulnerability in n/a, published on 5 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.
Weakness: CWE-119
Which versions are affected by CVE-2021-28036?
5 open source packages ship an affected version, including quinn. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
quinn crates.io | All versions | 0.5.4 |
quinn crates.io | All versions | 0.5.4 |
quinn crates.io | From 0.0.0-0 | 0.5.4, 0.6.2, 0.7.0 |
quinn crates.io | From 0.6.0 | 0.6.2 |
quinn crates.io | From 0.6.0 | 0.6.2 |
Products include Quinn Project Quinn.
How do I fix CVE-2021-28036?
Upgrade quinn to a fixed version for your release line: 0.5.4, 0.6.2 or 0.7.0.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-28036 being exploited?
There is no known exploitation of CVE-2021-28036 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fhv4-fx3v-77w6, RUSTSEC-2021-0035.