What is GHSA-cv7x-6rc6-pq5v?

GHSA-cv7x-6rc6-pq5v is a security advisory published by GitHub Security Advisories with Critical severity. Double free in containers

Which CVE IDs does GHSA-cv7x-6rc6-pq5v cover?

GHSA-cv7x-6rc6-pq5v covers the following CVE IDs: CVE-2021-25907. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cv7x-6rc6-pq5v?

GHSA-cv7x-6rc6-pq5v has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-cv7x-6rc6-pq5v?

GHSA-cv7x-6rc6-pq5v affects 1 product, including: rust/containers:\u003c 0.9.11.

GHSA-cv7x-6rc6-pq5vCriticalCVSS 9.8

Double free in containers

Vendor

GitHub Security Advisories

Published

August 25, 2021

Last Modified

June 13, 2023

🔗 CVE IDs covered (1)

CVE-2021-25907 →

📋 Description

Upon panic in a user-provided function f, fn mutate() & fn mutate2 drops twice a same object.

Affected versions of this crate did not guard against double drop while temporarily duplicating an object's ownership with ptr::read().

Dropping a same object can result in memory corruption.

The flaw was corrected in version "0.9.11" by fixing the code to abort upon panic.

🎯 Affected products1

rust/containers:< 0.9.11

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-25907
https://github.com/strake/containers.rs/issues/2
https://rustsec.org/advisories/RUSTSEC-2021-0010.html
https://github.com/advisories/GHSA-cv7x-6rc6-pq5v