CVE-2021-25907: Double free in containers

August 25, 2021 (updated June 13, 2023)

Upon panic in a user-provided function f, fn mutate() & fn mutate2 drops twice a same object.

Affected versions of this crate did not guard against double drop while temporarily duplicating an object’s ownership with ptr::read().

Dropping a same object can result in memory corruption.

The flaw was corrected in version “0.9.11” by fixing the code to abort upon panic.

References

github.com/advisories/GHSA-cv7x-6rc6-pq5v
github.com/strake/containers.rs
github.com/strake/containers.rs/issues/2
nvd.nist.gov/vuln/detail/CVE-2021-25907
rustsec.org/advisories/RUSTSEC-2021-0010.html

Code Behaviors & Features

Detect and mitigate CVE-2021-25907 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →