Vulnerabilities > CVE-2021-26951 - Use of Uninitialized Resource vulnerability in Calamine Project Calamine

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

calamine-project

CWE-908

NVD

Published: 2021-02-09

Updated: 2022-04-25

Summary

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.

Vulnerable Configurations

Part	Description	Count
Application	Calamine_Project Calamine Project Calamine - Calamine Project Calamine 0.13.1 Calamine Project Calamine 0.14 Calamine Project Calamine 0.14.1 Calamine Project Calamine 0.14.2 Calamine Project Calamine 0.14.3 Calamine Project Calamine 0.14.4 Calamine Project Calamine 0.14.6 Calamine Project Calamine 0.14.7 Calamine Project Calamine 0.14.8 Calamine Project Calamine 0.14.9 Calamine Project Calamine 0.14.10 Calamine Project Calamine 0.15.0 Calamine Project Calamine 0.15.1 Calamine Project Calamine 0.15.2 Calamine Project Calamine 0.15.3 Calamine Project Calamine 0.15.4 Calamine Project Calamine 0.15.5 Calamine Project Calamine 0.15.6 Calamine Project Calamine 0.16.0 Calamine Project Calamine 0.16.1 Calamine Project Calamine 0.16.2	22

Common Weakness Enumeration (CWE)

CWE-908 - Use of Uninitialized Resource

References

https://rustsec.org/advisories/RUSTSEC-2021-0015.html