CVE-2021-45705

CRITICAL9.8EPSS 0.43%

Aliased mutable references from `tls_rand` & `TlsWyRand`

發布日:2022/6/17修改日:2023/11/8

也稱為:GHSA-p6gj-gpc8-f8xw GHSA-r57r-j98g-587fRUSTSEC-2021-0114

描述

`TlsWyRand`'s implementation of `Deref` unconditionally dereferences a raw pointer, and returns multiple mutable references to the same object, which is undefined behavior.

受影響套件(3)

crates.io/nanorand>= 0.5.0, < 0.6.1
crates.io/nanorand>= 0.5.0, < 0.6.1
crates.io/nanorand>= 0.5.0, < 0.6.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-45705
PATCHhttps://crates.io/crates/nanorand
PATCHhttps://github.com/Absolucy/nanorand-rs
WEBhttps://github.com/Absolucy/nanorand-rs/issues/28
WEBhttps://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nanorand/RUSTSEC-2021-0114.md
WEBhttps://rustsec.org/advisories/RUSTSEC-2021-0114.html