Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-26307

CVE-2021-26307:
Error on unsupported architectures in raw-cpuid

5.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-26307
GHSA ID
GHSA-jrf8-cmgg-gv2m
EPSS Score
0.15529%
CWE
CWE-400
Published
8/25/2021
Updated
6/13/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
raw-cpuidrust< 9.0.09.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from native_cpuid::cpuid_count() wrapping the unsafe __cpuid_count intrinsic from core::arch as a safe function. This violates Rust's safety requirements as it doesn't verify the CPU supports the CPUID instruction, which isn't available in all x86/x86_64 environments (e.g., SGX or 32-bit x86 without SSE). The CVE description explicitly identifies this function as problematic, and the fix involved adding compilation guards for affected architectures. While other functions had memory safety issues (fixed via #[repr(C)]), this function directly relates to the CVE-2021-26307 vulnerability through its unsafe exposure of CPU-dependent intrinsics.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

n*tiv*_*pui*::*pui*_*ount() *xpos*s t** uns*** __*pui*_*ount() intrinsi* *rom *or*::*r**::x** or *or*::*r**::x**_** *s * s*** *un*tion, *n* us*s it int*rn*lly, wit*out ****kin* t** s***ty r*quir*m*nt: * T** *PU t** pro*r*m is *urr*ntly runnin* on su

Reasoning

T** vuln*r**ility st*ms *rom n*tiv*_*pui*::*pui*_*ount() wr*ppin* t** uns*** __*pui*_*ount intrinsi* *rom *or*::*r** *s * s*** *un*tion. T*is viol*t*s Rust's s***ty r*quir*m*nts *s it *o*sn't v*ri*y t** *PU supports t** *PUI* instru*tion, w*i** isn't