CVE-2021-45686

Vulnerability

CVE-2021-45686 is a memory-safety/soundness issue in the csv-sniffer crate for Rust, up to version 0.1.2. The function preamble_skipcount() in src/lib.rs creates a buffer with Vec::with_capacity(cap) and then uses unsafe { buffer.set_len(cap); } to set the length without initializing the memory [1][2][3]. This uninitialized buffer is then passed to a user-provided std::io::Read implementation via reader.read(&mut buffer) [3]. The affected versions pass an uninitialized buffer to user-provided code, violating Rust's safety guarantees.

Exploitation

To exploit this vulnerability, an attacker must control the Read implementation passed to preamble_skipcount() [2][3]. The function is pub(crate), so it is accessible within the crate and potentially through public APIs that expose it to external Read types. When the function is invoked, the Read::read() method can read the uninitialized buffer, exposing heap memory contents from previous allocations [3]. Additionally, if the Read implementation returns an arbitrary byte count, it can cause undefined behavior immediately [2]. No authentication or special privileges are required; only the ability to pass a crafted Read instance to the vulnerable function.

Impact

Successful exploitation allows an attacker to read uninitialized memory (memory exposure), resulting in the disclosure of sensitive data from the heap [2][3]. This can lead to undefined behavior (UB) because reading uninitialized memory produces undefined values that may include addresses or secrets [2]. The attacker may also cause further UB if the Read implementation returns incorrect byte counts, potentially leading to other security issues such as buffer over-reads or logic errors.

Mitigation

The vulnerability is fixed in version 0.2.0 of the csv-sniffer crate [2]. Patches were contributed in pull request #2 [4], which modernizes the code and removes the use of uninitialized buffers. Users should update to csv-sniffer >=0.2.0 immediately [2]. There is no known workaround for affected versions; the crate must be upgraded to avoid the unsound behavior.