CVE-2021-45687 Optional `Deserialize` implementations lacking validation
Attackers can trigger memory corruption or panics via insufficient validation during deserialization in the raw-cpuid crate when the serialize feature is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-45687?
CVE-2021-45687 is a critical unsafe deserialization vulnerability in n/a, published on 26 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.
Weakness: CWE-20
Which versions are affected by CVE-2021-45687?
5 open source packages ship an affected version, including raw-cpuid. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
raw-cpuid crates.io | From 3.1.0 | 9.1.1 |
raw-cpuid crates.io | From 3.1.0 | 9.1.1 |
raw-cpuid crates.io | From 3.1.0 | 9.1.1 |
raw-cpuid crates.io | From 3.1.0 | 9.1.1 |
raw-cpuid crates.io | From 3.1.1-0 | 9.1.1 |
Products include Raw-Cpuid Project Raw-Cpuid.
How do I fix CVE-2021-45687?
Upgrade raw-cpuid to 9.1.1 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-45687 being exploited?
There is no known exploitation of CVE-2021-45687 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jf5h-cf95-w759, GHSA-w428-f65r-h4q2, RUSTSEC-2021-0089.