Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2021-32810

kritisch

CVE-2021-32810

rust-crossbeam-deque: race condition may lead to double free

Veröffentlicht Geändert CWE 362
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Amazon (hoch), Oracle (hoch), Rocky Linux (hoch), Red Hat (mittel), Ubuntu (mittel).

Beschreibung

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
cargo::GitHub Security Advisory Rustcrossbeam-deque0.7.4, 0.8.1
alpine 3.15firefox, firefox-esr93.0-r0 und 1 weitere
alpine 3.16firefox, firefox-esr, thunderbird93.0-r0 und 2 weitere
alpine 3.17firefox, firefox-esr, thunderbird93.0-r0 und 2 weitere
alpine 3.18firefox, firefox-esr, thunderbird93.0-r0 und 2 weitere
alpine 3.19firefox, firefox-esr, thunderbird93.0-r0 und 2 weitere
alpine 3.20firefox, firefox-esr, thunderbird93.0-r0 und 2 weitere
alpine 3.21firefox, firefox-esr, librewolf und 1 weitere93.0-r0 und 2 weitere
alpine 3.22firefox, firefox-esr, librewolf und 1 weitere93.0-r0 und 2 weitere
alpine 3.23firefox, firefox-esr, librewolf und 1 weitere93.0-r0 und 2 weitere
alpine 3.24librewolf93.0-r0
alpine edgelibrewolf93.0-r0
Alle 62 Einträge aus 37 Quellen zeigen
QuellePaketBehoben in
cargo::GitHub Security Advisory Rustcrossbeam-deque0.7.4, 0.8.1
alpine 3.15firefox93.0-r0
alpine 3.15firefox-esr91.2.0-r0
alpine 3.16firefox93.0-r0
alpine 3.16firefox-esr91.2.0-r0
alpine 3.16thunderbird91.3.2-r0
alpine 3.17firefox93.0-r0
alpine 3.17firefox-esr91.2.0-r0
alpine 3.17thunderbird91.3.2-r0
alpine 3.18firefox93.0-r0
alpine 3.18firefox-esr91.2.0-r0
alpine 3.18thunderbird91.3.2-r0
alpine 3.19firefox93.0-r0
alpine 3.19firefox-esr91.2.0-r0
alpine 3.19thunderbird91.3.2-r0
alpine 3.20firefox93.0-r0
alpine 3.20firefox-esr91.2.0-r0
alpine 3.20thunderbird91.3.2-r0
alpine 3.21firefox93.0-r0
alpine 3.21firefox-esr91.2.0-r0
alpine 3.21librewolf93.0-r0
alpine 3.21thunderbird91.3.2-r0
alpine 3.22firefox93.0-r0
alpine 3.22firefox-esr91.2.0-r0
alpine 3.22librewolf93.0-r0
alpine 3.22thunderbird91.3.2-r0
alpine 3.23firefox93.0-r0
alpine 3.23firefox-esr91.2.0-r0
alpine 3.23librewolf93.0-r0
alpine 3.23thunderbird91.3.2-r0
alpine 3.24librewolf93.0-r0
alpine edgelibrewolf93.0-r0
amazon linux 2thunderbird91.6.0-1.amzn2.0.1
amazon linux 2thunderbird-debuginfo91.6.0-1.amzn2.0.1
debian 10rust-crossbeam-dequekein Fix angegeben
debian 11rust-crossbeam-dequekein Fix angegeben
debian 12rust-crossbeam-deque0.7.4-1
debian 13rust-crossbeam-deque0.7.4-1
debian 14rust-crossbeam-deque0.7.4-1
echorust-crossbeam-deque0.7.4-1
Oracle Linux 7firefox91.2.0-4.0.1.el7_9
Oracle Linux 7thunderbird91.2.0-1.0.1.el7_9
Oracle Linux 8firefox91.2.0-4.0.1.el8_4
Oracle Linux 8thunderbird91.2.0-1.0.1.el8_4
Red Hatfirefoxkein Fix angegeben
Red Hatthunderbirdkein Fix angegeben
rocky 8firefox91.2.0-4.el8_4
rocky 8thunderbird91.2.0-1.el8_4
ubuntu 18.04firefox93.0+build1-0ubuntu0.18.04.1
ubuntu 20.04firefox93.0+build1-0ubuntu0.20.04.1
ubuntu 21.04firefox93.0+build1-0ubuntu0.21.04.1
ubuntu 21.10firefox93.0+build1-0ubuntu2
ubuntu 22.04firefox93.0+build1-0ubuntu2
ubuntu 22.10firefox93.0+build1-0ubuntu2
ubuntu 23.04firefox93.0+build1-0ubuntu2
ubuntu 23.10firefox93.0+build1-0ubuntu2
ubuntu 24.04firefox93.0+build1-0ubuntu2
ubuntu 24.10firefox93.0+build1-0ubuntu2
ubuntu 25.04firefox93.0+build1-0ubuntu2
ubuntu 25.10firefox93.0+build1-0ubuntu2
ubuntu 26.04firefox93.0+build1-0ubuntu2
ubuntu 26.10firefox93.0+build1-0ubuntu2

Referenzen

Alle 45 Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.