CVE-2021-28877 Memory corruption in n/a

High 7.5 Published 11 Apr 2021 Updated 3 Aug 2024

A memory safety violation in the Rust standard library's Zip implementation allows attackers to potentially execute arbitrary code or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-28877?

CVE-2021-28877 is a high-severity memory corruption vulnerability in n/a, published on 11 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

Weakness: CWE-119

Which versions are affected by CVE-2021-28877?

It affects 1 product.

Products include Rust-Lang Rust.

How do I fix CVE-2021-28877?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-28877 being exploited?

There is no known exploitation of CVE-2021-28877 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2021-28877, GHSA-r23x-h32h-x9jh, UBUNTU-CVE-2021-28877.