Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-45685

CVE-2021-45685: columnar: Read on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-45685
GHSA ID
GHSA-9mp7-45qh-r8j8
EPSS Score
0.61972%
CWE
CWE-908
Published
1/6/2022
Updated
6/13/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
columnarrust<= 0.0.19

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability is explicitly documented in multiple sources (CVE, GHSA, RustSec) as residing in ColumnarReadExt::read_typed_vec(). The provided code sample shows unsafe usage of set_len followed by reading into uninitialized memory via a user-controlled Read implementation. The unsafe block manipulating vector length and the subsequent read into an uninitialized slice directly matches the described vulnerability pattern of CWE-908 (Use of Uninitialized Resource).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*****t** v*rsions o* t*is *r*t* p*ss*s *n uniniti*liz** *u***r to * us*r-provi*** R*** impl*m*nt*tion (*olumn*rR****xt::r***_typ**_v**()). *r*itr*ry R*** impl*m*nt*tions **n r*** *rom t** uniniti*liz** *u***r (m*mory *xposur*) *n* *lso **n r*turn in

Reasoning

T** vuln*r**ility is *xpli*itly *o*um*nt** in multipl* sour**s (*V*, **S*, RustS**) *s r*si*in* in *olumn*rR****xt::r***_typ**_v**(). T** provi*** *o** s*mpl* s*ows uns*** us*** o* s*t_l*n *ollow** *y r***in* into uniniti*liz** m*mory vi* * us*r-*ont