CVE-2021-29938
📋 TL;DR
This vulnerability in the Rust slice-deque crate allows a double free/double drop condition when a panic occurs in a predicate function during SliceDeque::drain_filter operations. This can lead to memory corruption and potential code execution. Any Rust application using the affected versions of the slice-deque crate is vulnerable.
💻 Affected Systems
- slice-deque Rust crate
📦 What is this software?
Slice Deque by Slice Deque Project
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to arbitrary code execution, potentially allowing attackers to take full control of affected systems.
Likely Case
Application crashes, denial of service, or memory corruption that could be leveraged for further exploitation.
If Mitigated
Application crashes with minimal data loss if proper memory safety controls and sandboxing are in place.
🎯 Exploit Status
Exploitation requires triggering a panic in the predicate function during drain_filter operations, which may be difficult to achieve remotely without specific application context.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: slice-deque 0.3.0 or later
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2021-0047.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to use slice-deque >= 0.3.0
2. Run 'cargo update' to fetch the fixed version
3. Rebuild and redeploy your Rust application
4. Restart any running services using the updated application
🔧 Temporary Workarounds
Avoid drain_filter with panicking predicates
allModify code to ensure predicate functions in drain_filter calls cannot panic
Review and modify Rust source code to handle errors without panicking in drain_filter predicates
🧯 If You Can't Patch
- Implement runtime panic handlers to catch and safely handle panics in drain_filter predicates
- Isolate affected applications in containers or sandboxes to limit potential damage from memory corruption
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or Cargo.toml for slice-deque dependency version < 0.3.0Check Version:
grep slice-deque Cargo.lockVerify Fix Applied:
Verify slice-deque version is >= 0.3.0 in Cargo.lock after update📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory corruption errors
- Panic messages from slice-deque drain_filter operations
Network Indicators:
- Sudden application termination without normal shutdown
SIEM Query:
source="application.logs" AND ("panic" OR "double free" OR "memory corruption") AND "slice-deque"