CVE-2021-32810

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-32810
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-32810.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-32810
Aliases
Related
Published
2021-08-02T19:15:08Z
Modified
2024-10-12T07:36:30.601025Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using Stealer::steal, Stealer::steal_batch, or Stealer::steal_batch_and_pop are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.

References

Affected packages

Debian:11 / rust-crossbeam-deque

Package

Name
rust-crossbeam-deque
Purl
pkg:deb/debian/rust-crossbeam-deque?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.7.3-1
0.7.4-1
0.7.4-2
0.8.1-1
0.8.3-1
0.8.5-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / rust-crossbeam-deque

Package

Name
rust-crossbeam-deque
Purl
pkg:deb/debian/rust-crossbeam-deque?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.7.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / rust-crossbeam-deque

Package

Name
rust-crossbeam-deque
Purl
pkg:deb/debian/rust-crossbeam-deque?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.7.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/crossbeam-rs/crossbeam

Affected ranges

Type
GIT
Repo
https://github.com/crossbeam-rs/crossbeam
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
048513769238eda1876bcc61b131b2ece32f87dd

Affected versions

0.*

0.2.10

crossbeam-0.*

crossbeam-0.5.0
crossbeam-0.6.0
crossbeam-0.7.0
crossbeam-0.7.1
crossbeam-0.7.2
crossbeam-0.7.3

crossbeam-channel-0.*

crossbeam-channel-0.3.1
crossbeam-channel-0.3.2
crossbeam-channel-0.3.3
crossbeam-channel-0.3.4
crossbeam-channel-0.3.5
crossbeam-channel-0.3.6
crossbeam-channel-0.3.7
crossbeam-channel-0.3.8
crossbeam-channel-0.3.9
crossbeam-channel-0.4.0
crossbeam-channel-0.4.2
crossbeam-channel-0.4.4

crossbeam-deque-0.*

crossbeam-deque-0.6.2
crossbeam-deque-0.6.3
crossbeam-deque-0.7.0
crossbeam-deque-0.7.1
crossbeam-deque-0.7.2

crossbeam-epoch-0.*

crossbeam-epoch-0.6.1
crossbeam-epoch-0.7.0
crossbeam-epoch-0.7.1
crossbeam-epoch-0.7.2
crossbeam-epoch-0.8.0
crossbeam-epoch-0.8.2

crossbeam-queue-0.*

crossbeam-queue-0.1.0
crossbeam-queue-0.1.1
crossbeam-queue-0.1.2
crossbeam-queue-0.2.0
crossbeam-queue-0.2.1
crossbeam-queue-0.2.3

crossbeam-utils-0.*

crossbeam-utils-0.1.0
crossbeam-utils-0.6.0
crossbeam-utils-0.6.1
crossbeam-utils-0.6.2
crossbeam-utils-0.6.3
crossbeam-utils-0.6.4
crossbeam-utils-0.6.5
crossbeam-utils-0.6.6
crossbeam-utils-0.7.0
crossbeam-utils-0.7.2

v0.*

v0.0.0
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.3.0
v0.3.1
v0.3.2
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.5.1
v0.5.2
v0.6.0
v0.6.1