CVE-2021-45685 columnar: Read on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())
Attackers can read uninitialized memory via the read_typed_vec function in the Rust columnar crate, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-45685?
CVE-2021-45685 is a critical vulnerability in n/a, published on 26 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations.
Weakness: CWE-908
Which versions are affected by CVE-2021-45685?
5 open source packages ship an affected version, including columnar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
columnar crates.io | All versions to 0.0.19 | None |
columnar crates.io | All versions to 0.0.19 | None |
columnar crates.io | All versions to 0.0.19 | None |
columnar crates.io | All versions to 0.0.19 | None |
columnar crates.io | From 0.0.0-0 | 0.1.0 |
Products include Columnar Project Columnar.
How do I fix CVE-2021-45685?
Upgrade columnar to 0.1.0 or later.
Is CVE-2021-45685 being exploited?
There is no known exploitation of CVE-2021-45685 in the wild and no public exploit code.
Sources
Also known as GHSA-9mp7-45qh-r8j8, GHSA-cxcc-q839-2cw9, RUSTSEC-2021-0087.