high7.5
CVE-2021-31919
Use of uninitialized buffer in rkyv
Impact
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | rkyv | < 0.6.0 | 0.6.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rkyv Project | Rkyv | before 0.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://rustsec.org/advisories/RUSTSEC-2021-0054.html
- https://github.com/advisories/GHSA-w5cr-frph-hw7f
- https://nvd.nist.gov/vuln/detail/CVE-2021-31919
- https://github.com/djkoloski/rkyv/commit/9c65ae9c2c67dd949b5c3aba9b8eba6da802ab7e
- https://github.com/djkoloski/rkyv/commit/f141b560523a20557db6540576d153010bd18712
- https://github.com/djkoloski/rkyv/issues/113