CVE-2021-38192
📋 TL;DR
This vulnerability in the prost-types Rust crate allows integer overflow when converting Timestamp to SystemTime, potentially causing crashes or undefined behavior. It affects Rust applications using prost-types versions before 0.8.0 for timestamp handling.
💻 Affected Systems
- prost-types Rust crate
📦 What is this software?
Prost by Prost Project
⚠️ Risk & Real-World Impact
Worst Case
Denial of service through application crashes, or potential memory corruption leading to arbitrary code execution in worst-case scenarios.
Likely Case
Application crashes or unexpected behavior when processing malformed timestamp data.
If Mitigated
Minimal impact if proper input validation and error handling are implemented.
🎯 Exploit Status
Exploitation requires ability to provide malformed timestamp data to vulnerable conversion functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.0 and later
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2021-0073.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to require prost-types >= 0.8.0
2. Run 'cargo update prost-types'
3. Rebuild and redeploy application
4. Restart affected services
🔧 Temporary Workarounds
Input validation
allImplement validation of timestamp values before conversion
Dependency pinning
allPin prost-types to patched version in Cargo.lock
cargo update --package prost-types --precise 0.8.0
🧯 If You Can't Patch
- Implement strict input validation for all timestamp data
- Wrap timestamp conversion calls in try-catch blocks with proper error handling
🔍 How to Verify
Check if Vulnerable:
Check Cargo.toml or Cargo.lock for prost-types version < 0.8.0Check Version:
grep prost-types Cargo.lock | grep versionVerify Fix Applied:
Verify prost-types >= 0.8.0 in Cargo.lock and test timestamp conversions📡 Detection & Monitoring
Log Indicators:
- Application crashes during timestamp processing
- Panic messages related to integer overflow
Network Indicators:
- Unusual timestamp values in incoming data
SIEM Query:
source="application.log" AND ("panic" OR "overflow" OR "timestamp")🔗 References
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/prost-types/RUSTSEC-2021-0073.md
- https://rustsec.org/advisories/RUSTSEC-2021-0073.html
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/prost-types/RUSTSEC-2021-0073.md
- https://rustsec.org/advisories/RUSTSEC-2021-0073.html
