CVE-2021-25903

Vulnerability

Analysis

The cache crate (crates.io) prior to the advisory date contains a flaw where an internally used raw pointer is exposed or dereferenced unsafely [2]. The official description states simply that a raw pointer is dereferenced, which in Rust indicates a violation of memory safety guarantees [1]. This unsoundness can cause the program to access invalid memory, leading to undefined behavior.

Attack

Vector

An attacker can exploit this vulnerability over the network without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) [2]. The low attack complexity suggests that crafting an exploit does not require special conditions. However, the exact mechanism of exploitation depends on how the cache is populated and accessed; an attacker would need to provide or control data that triggers the raw pointer dereference.

Impact

The primary impact is availability — the vulnerability has a high impact on availability, meaning an exploit can crash the application or cause a denial of service [2]. There is no confidentiality or integrity impact noted in the CVSS vector. The RustSec advisory categorizes this as an "Unsound" issue that can lead to memory corruption [2].

Mitigation

According to the RustSec advisory, no patched versions of the cache crate have been released [2]. Users of the crate should evaluate their dependence on it and consider replacing it with an alternative crate that provides similar functionality with safe memory handling. The advisory was last modified in June 2023, and the crate may be considered unmaintained.