Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / CVE-2021-32810

critique

CVE-2021-32810

rust-crossbeam-deque: race condition may lead to double free

Publiée Modifiée CWE 362
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Amazon (élevée), Oracle (élevée), Rocky Linux (élevée), Red Hat (moyenne), Ubuntu (moyenne).

Description

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
cargo::GitHub Security Advisory Rustcrossbeam-deque0.7.4, 0.8.1
alpine 3.15firefox, firefox-esr93.0-r0 et 1 autres
alpine 3.16firefox, firefox-esr, thunderbird93.0-r0 et 2 autres
alpine 3.17firefox, firefox-esr, thunderbird93.0-r0 et 2 autres
alpine 3.18firefox, firefox-esr, thunderbird93.0-r0 et 2 autres
alpine 3.19firefox, firefox-esr, thunderbird93.0-r0 et 2 autres
alpine 3.20firefox, firefox-esr, thunderbird93.0-r0 et 2 autres
alpine 3.21firefox, firefox-esr, librewolf et 1 autres93.0-r0 et 2 autres
alpine 3.22firefox, firefox-esr, librewolf et 1 autres93.0-r0 et 2 autres
alpine 3.23firefox, firefox-esr, librewolf et 1 autres93.0-r0 et 2 autres
alpine 3.24librewolf93.0-r0
alpine edgelibrewolf93.0-r0
Afficher les 62 entrées de 37 sources
SourcePaquetCorrigé en
cargo::GitHub Security Advisory Rustcrossbeam-deque0.7.4, 0.8.1
alpine 3.15firefox93.0-r0
alpine 3.15firefox-esr91.2.0-r0
alpine 3.16firefox93.0-r0
alpine 3.16firefox-esr91.2.0-r0
alpine 3.16thunderbird91.3.2-r0
alpine 3.17firefox93.0-r0
alpine 3.17firefox-esr91.2.0-r0
alpine 3.17thunderbird91.3.2-r0
alpine 3.18firefox93.0-r0
alpine 3.18firefox-esr91.2.0-r0
alpine 3.18thunderbird91.3.2-r0
alpine 3.19firefox93.0-r0
alpine 3.19firefox-esr91.2.0-r0
alpine 3.19thunderbird91.3.2-r0
alpine 3.20firefox93.0-r0
alpine 3.20firefox-esr91.2.0-r0
alpine 3.20thunderbird91.3.2-r0
alpine 3.21firefox93.0-r0
alpine 3.21firefox-esr91.2.0-r0
alpine 3.21librewolf93.0-r0
alpine 3.21thunderbird91.3.2-r0
alpine 3.22firefox93.0-r0
alpine 3.22firefox-esr91.2.0-r0
alpine 3.22librewolf93.0-r0
alpine 3.22thunderbird91.3.2-r0
alpine 3.23firefox93.0-r0
alpine 3.23firefox-esr91.2.0-r0
alpine 3.23librewolf93.0-r0
alpine 3.23thunderbird91.3.2-r0
alpine 3.24librewolf93.0-r0
alpine edgelibrewolf93.0-r0
amazon linux 2thunderbird91.6.0-1.amzn2.0.1
amazon linux 2thunderbird-debuginfo91.6.0-1.amzn2.0.1
debian 10rust-crossbeam-dequepas de correctif indiqué
debian 11rust-crossbeam-dequepas de correctif indiqué
debian 12rust-crossbeam-deque0.7.4-1
debian 13rust-crossbeam-deque0.7.4-1
debian 14rust-crossbeam-deque0.7.4-1
echorust-crossbeam-deque0.7.4-1
Oracle Linux 7firefox91.2.0-4.0.1.el7_9
Oracle Linux 7thunderbird91.2.0-1.0.1.el7_9
Oracle Linux 8firefox91.2.0-4.0.1.el8_4
Oracle Linux 8thunderbird91.2.0-1.0.1.el8_4
Red Hatfirefoxpas de correctif indiqué
Red Hatthunderbirdpas de correctif indiqué
rocky 8firefox91.2.0-4.el8_4
rocky 8thunderbird91.2.0-1.el8_4
ubuntu 18.04firefox93.0+build1-0ubuntu0.18.04.1
ubuntu 20.04firefox93.0+build1-0ubuntu0.20.04.1
ubuntu 21.04firefox93.0+build1-0ubuntu0.21.04.1
ubuntu 21.10firefox93.0+build1-0ubuntu2
ubuntu 22.04firefox93.0+build1-0ubuntu2
ubuntu 22.10firefox93.0+build1-0ubuntu2
ubuntu 23.04firefox93.0+build1-0ubuntu2
ubuntu 23.10firefox93.0+build1-0ubuntu2
ubuntu 24.04firefox93.0+build1-0ubuntu2
ubuntu 24.10firefox93.0+build1-0ubuntu2
ubuntu 25.04firefox93.0+build1-0ubuntu2
ubuntu 25.10firefox93.0+build1-0ubuntu2
ubuntu 26.04firefox93.0+build1-0ubuntu2
ubuntu 26.10firefox93.0+build1-0ubuntu2

Références

Les 45 références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.