CVE-2021-45682

Vulnerability

The bronzedb-protocol crate up to version 2021-01-03 for Rust contains a soundness issue in its ReadKVExt trait implementation. The read_key() and read_value() methods create a Vec with uninitialized memory using Vec::set_len() before passing it to a user-provided Read implementation via read_exact(). This allows safe Rust code to read from uninitialized memory locations, which constitutes undefined behavior. Affected versions include all releases up to and including the version dated 2021-01-03; no patched version has been released [1][3][4].

Exploitation

An attacker needs to control the Read implementation supplied to the affected methods. If a user implements the Read trait for a custom type and provides it to ReadKVExt::read_key() or read_value(), the attacker's Read implementation can deliberately read from the uninitialized buffer passed by the crate. The attacker can also return an incorrect number of bytes, causing the buffer to contain uninitialized data upon return. The exploit does not require network access or privilege escalation beyond the ability to pass a malicious Read instance to the affected functions [3][4].

Impact

Successful exploitation allows an attacker to read uninitialized memory, leading to potential exposure of sensitive data (memory disclosure). Since reading uninitialized memory produces undefined values, this can quickly trigger undefined behavior, which may result in more severe consequences such as crashes or arbitrary code execution, depending on how the returned data is used. The compromise occurs entirely within the unsafe code boundary of the crate [3][4].

Mitigation

As of the latest advisory, there is no patched version of bronzedb-protocol available. The RustSec advisory lists "no patched versions" [4]. Users should avoid using the ReadKVExt trait with untrusted Read implementations, or remove reliance on this crate entirely. Alternative crates or manual memory-safe implementations are recommended. No CVE entry has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.