CVE-2021-32810criticalCWE-362

CVE-2021-32810: critical vulnerability in crossbeam-rs crossbeam

Data race in crossbeam-deque

Published 02 Aug 2021 · Updated 03 Aug 2024

Follow this CVE + Monitor crossbeam + Monitor firefox-esr

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.9%

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

crossbeam-rs · crossbeam

Related CVEs — crossbeam-rs crossbeam

In the same product, most dangerous first.

CVE-2020-15254HIGHUndefined Behavior in bounded Crossbeam channelEPSS 2.7%CVE-2022-23639HIGHImproper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utilsEPSS 1.2%

References