CVE-2021-27378 — Incorrect Calculation of Buffer Size in Core Project Rand Core

CWE-131 — Incorrect Calculation of Buffer SizeCWE-330 — Use of Insufficiently Random Values7 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.5%
top 35.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Rand Core Project Rand CoreDebian Rust-rand-coreMsrc Azl3 Librsvg2 2.50.3-4 ON Azure Linux 3.0+4 more
Timeline
PublishedFeb 18
Latest updateAug 25

Description

An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random number generator may be seeded with too little data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages8 packages

▶NVDrand_core_project/rand_core0.6.0 — 0.6.2
▶crates.iorand_core_project/rand_core0.6.0 — 0.6.2

🔴Vulnerability Details

4
GHSA
Incorrect check on buffer length in rand_core↗2021-08-25
▶
OSV
Incorrect check on buffer length in rand_core↗2021-08-25
▶
OSV
CVE-2021-27378: An issue was discovered in the rand_core crate before 0↗2021-02-18
▶
OSV
Incorrect check on buffer length when seeding RNGs↗2021-02-12
▶

📋Vendor Advisories

2
Microsoft
An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks a random number generator may be seeded with too li↗2021-02-09
▶
Debian
CVE-2021-27378: rust-rand-core - An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because re...↗2021
▶
CVE-2021-27378 — Incorrect Calculation of Buffer Size | cvebase