CVE-2021-38190 Out of bounds write in nalgebra
Out-of-bounds memory access in the nalgebra Rust crate allows attackers to potentially execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-38190?
CVE-2021-38190 is a critical memory corruption vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the nalgebra crate before 0.27.1 for Rust. It allows out-of-bounds memory access because it does not ensure that the number of elements is equal to the product of the row count and column count.
Weakness: CWE-119
Which versions are affected by CVE-2021-38190?
3 open source packages ship an affected version, including nalgebra. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nalgebra crates.io | From 0.11.0 | 0.27.1 |
nalgebra crates.io | From 0.11.0 | 0.27.1 |
nalgebra crates.io | From 0.11.0 | 0.27.1 |
Products include Dimforge Nalgebra.
How do I fix CVE-2021-38190?
Upgrade nalgebra to 0.27.1 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-38190 being exploited?
There is no known exploitation of CVE-2021-38190 in the wild and no public exploit code.
Sources
Also known as AZL-41989, GHSA-3w8g-xr3f-2mp8, RUSTSEC-2021-0070.