kritisch
CVE-2021-31162
rust: double free in Vec::from_iter function if freeing the element panics
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, CBL-Mariner, Photon OS. Niedriger laut Red Hat (mittel), Amazon (mittel), Oracle (mittel), Rocky Linux (mittel), Ubuntu (mittel).
Beschreibung
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| CBL-Mariner 1.0 | rust | 0:1.59.0-1.cm1 |
| Photon OS 3.0 | rust | 1.51.0-1.ph3 |
| Photon OS 4.0 | rust | 1.51.0-1.ph4 |
| alpine 3.14 | rust | 1.51.0-r2 |
| alpine 3.15 | rust | 1.51.0-r2 |
| alpine 3.16 | rust | 1.51.0-r2 |
| alpine 3.17 | rust | 1.51.0-r2 |
| alpine 3.18 | rust | 1.51.0-r2 |
| alpine 3.19 | rust | 1.51.0-r2 |
| alpine 3.20 | rust | 1.51.0-r2 |
| alpine 3.21 | rust | 1.51.0-r2 |
| alpine 3.22 | rust | 1.51.0-r2 |
Alle 87 Einträge aus 31 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| CBL-Mariner 1.0 | rust | 0:1.59.0-1.cm1 |
| Photon OS 3.0 | rust | 1.51.0-1.ph3 |
| Photon OS 4.0 | rust | 1.51.0-1.ph4 |
| alpine 3.14 | rust | 1.51.0-r2 |
| alpine 3.15 | rust | 1.51.0-r2 |
| alpine 3.16 | rust | 1.51.0-r2 |
| alpine 3.17 | rust | 1.51.0-r2 |
| alpine 3.18 | rust | 1.51.0-r2 |
| alpine 3.19 | rust | 1.51.0-r2 |
| alpine 3.20 | rust | 1.51.0-r2 |
| alpine 3.21 | rust | 1.51.0-r2 |
| alpine 3.22 | rust | 1.51.0-r2 |
| alpine 3.23 | rust | 1.51.0-r2 |
| alpine 3.24 | chromium-rust | 1.51.0-r2 |
| alpine 3.24 | rust | 1.51.0-r2 |
| alpine edge | rust | 1.51.0-r2 |
| amazon linux 2 | cargo | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | cargo-doc | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | clippy | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rls | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-analysis | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-debugger-common | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-debuginfo | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-doc | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-gdb | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-src | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rust-std-static | 1.56.1-1.amzn2.0.1 |
| amazon linux 2 | rustfmt | 1.56.1-1.amzn2.0.1 |
| debian 10 | rustc | kein Fix angegeben |
| debian 11 | rustc | kein Fix angegeben |
| debian 12 | rustc | 1.53.0+dfsg1-1 |
| debian 13 | rustc | 1.53.0+dfsg1-1 |
| debian 14 | rustc | 1.53.0+dfsg1-1 |
| debian 9 | rustc | kein Fix angegeben |
| echo | rustc | 1.53.0+dfsg1-1 |
| Oracle Linux 8 | cargo | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | cargo-doc | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | clippy | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rls | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-analysis | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-debugger-common | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-doc | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-gdb | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-lldb | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-src | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-std-static | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rust-toolset | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| Oracle Linux 8 | rustfmt | 1.52.1-1.module+el8.4.0+20287+5ada6442 |
| rapidfort ubuntu 20.04 | rf-rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1 |
| rapidfort ubuntu 20.04 | rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1 |
| rapidfort ubuntu 22.04 | rf-rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1 |
| rapidfort ubuntu 22.04 | rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1 |
| rapidfort ubuntu 24.04 | rf-rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1 |
| rapidfort ubuntu 24.04 | rustc | 0:1.61.0+dfsg1-1~exp1ubuntu1, 0:1.68.0+dfsg0ubuntu1-0ubuntu1 |
| rocky 8 | cargo | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | cargo-doc | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | clippy | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rls | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-analysis | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-debugger-common | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-doc | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-gdb | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-lldb | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-src | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-std-static | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::cargo | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::cargo-doc | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::clippy | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rls | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-analysis | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-debugger-common | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-doc | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-gdb | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-lldb | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-src | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-std-static | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rust-toolset | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rust-toolset:rhel8::rustfmt | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| rocky 8 | rustfmt | 1.52.1-1.module+el8.4.0+641+ca238f88 |
| ubuntu 20.04 | rustc | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 |
| ubuntu 20.04-ESM | rustc | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 |
| ubuntu 22.04 | rustc | 1.53.0+dfsg1+llvm-4ubuntu1 |
Referenzen
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-36323.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28875.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28876.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28877.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28878.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-28879.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-31162.json
- https://access.redhat.com/security/cve/CVE-2021-31162
Alle 19 Referenzen
- https://github.com/rust-lang/rust/issues/83618
- https://github.com/rust-lang/rust/pull/83629
- https://github.com/rust-lang/rust/pull/84603
- https://linux.oracle.com/cve/CVE-2021-31162.html
- https://linux.oracle.com/errata/ELSA-2021-3063.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/
- https://nvd.nist.gov/vuln/detail/CVE-2021-31162
- https://security.gentoo.org/glsa/202210-09
- https://www.cve.org/CVERecord?id=CVE-2021-31162