CVE-2021-45720

Vulnerability

The lru crate (versions before 0.7.1) for Rust contains a use-after-free vulnerability in its iter() and iter_mut() methods. When a caller holds a reference obtained from the iterator and then calls pop() on the cache, the value is freed, but the reference remains accessible, leading to a use-after-free condition [1][2][3].

Exploitation

An attacker can trigger this by writing code that iterates over the cache and calls pop() on the current key while still holding the reference to the value. No special network position or authentication is required; the vulnerability is exploitable locally by any Rust program using the affected crate. The provided proof-of-concept demonstrates a segmentation fault [1].

Impact

Successful exploitation results in reading freed memory, which can lead to information disclosure or potentially arbitrary code execution depending on the memory layout. The RustSec advisory categorizes this as memory corruption [3].

Mitigation

The vulnerability is fixed in lru version 0.7.1 and later [3]. Users should update to at least 0.7.1. No workaround is available; the only mitigation is to upgrade.