{"id":"CVE-2021-25907","aliases":["RUSTSEC-2021-0010"],"url":"https://o3.security/vulnerability/CVE-2021-25907","summary":"Double free in containers","details":"Upon panic in a user-provided function f, fn mutate() & fn mutate2 drops twice a same object.\n\nAffected versions of this crate did not guard against double drop while temporarily duplicating an object's ownership with ptr::read().\n\nDropping a same object can result in memory corruption.\n\nThe flaw was corrected in version \"0.9.11\" by fixing the code to abort upon panic.","published":"2021-08-25T20:53:05Z","modified":"2023-11-08T04:05:16.917657Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"crates.io","name":"containers","fixedVersion":"0.9.11"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25907"},{"type":"WEB","url":"https://github.com/strake/containers.rs/issues/2"},{"type":"PACKAGE","url":"https://github.com/strake/containers.rs"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2021-0010.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T04:05:16.917657Z"}}