Vulnerability · Published Apr 14, 2021 · Assigned by mitre
CVE-2021-31162
Critical 9.8
In plain English
A critical-severity security flaw in the chromium-rust package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.9%top 13.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | chromium-rust | 1.51.0-r2 | ALPINE-CVE-2021-31162 |
| Alpine:v3.20 | rust | 1.51.0-r2 | ALPINE-CVE-2021-31162 |
| Alpine:v3.21 | rust | 1.51.0-r2 | ALPINE-CVE-2021-31162 |
| Alpine:v3.22 | rust | 1.51.0-r2 | ALPINE-CVE-2021-31162 |
| Alpine:v3.23 | rust | 1.51.0-r2 | ALPINE-CVE-2021-31162 |
| Alpine:v3.24 | rust | 1.51.0-r2 | ALPINE-CVE-2021-31162 |
| Debian:12 | rustc | 1.53.0+dfsg1-1 | DEBIAN-CVE-2021-31162 |
| Debian:13 | rustc | 1.53.0+dfsg1-1 | DEBIAN-CVE-2021-31162 |
| Debian:14 | rustc | 1.53.0+dfsg1-1 | DEBIAN-CVE-2021-31162 |
| Rocky Linux:8 | rust | 0:1.52.1-1.module+el8.4.0+641+ca238f88 | RLSA-2021:3063 |
| Rocky Linux:8 | rust-toolset | 0:1.52.1-1.module+el8.4.0+641+ca238f88 | RLSA-2021:3063 |
| Ubuntu:22.04:LTS | rustc | 1.53.0+dfsg1+llvm-4ubuntu1 | UBUNTU-CVE-2021-31162 |
Affected products (as reported)
References
- https://github.com/rust-lang/rust/issues/83618
- https://github.com/rust-lang/rust/pull/83629
- FEDORA-2021-d0ba1901ca vendor-advisory
- FEDORA-2021-b1ba54add6 vendor-advisory
- FEDORA-2021-d7f74f0250 vendor-advisory
- https://github.com/rust-lang/rust/pull/84603
- GLSA-202210-09 vendor-advisory