CVE-2021-45692
📋 TL;DR
This vulnerability in the messagepack-rs Rust crate allows attackers to read uninitialized memory during deserialization of certain extension types. This can lead to information disclosure or potentially remote code execution if combined with other vulnerabilities. Any Rust application using vulnerable versions of messagepack-rs for deserializing untrusted MessagePack data is affected.
💻 Affected Systems
- messagepack-rs Rust crate
📦 What is this software?
Messagepack Rs by Messagepack Rs Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with memory corruption vulnerabilities
Likely Case
Information disclosure of sensitive memory contents, potentially including application secrets or user data
If Mitigated
Limited impact if only trusted data sources are used or proper input validation is implemented
🎯 Exploit Status
Exploitation requires crafting malicious MessagePack extension data and triggering deserialization
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to messagepack-rs 0.8.0 or later
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2021-0092.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to require messagepack-rs >= 0.8.0
2. Run 'cargo update messagepack-rs'
3. Rebuild and redeploy your application
4. Restart affected services
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation to reject untrusted MessagePack extension data
Network segmentation
allIsolate services using messagepack-rs from untrusted networks
🧯 If You Can't Patch
- Implement strict input validation to reject all MessagePack extension types
- Use network controls to limit access to affected services to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or run 'cargo tree | grep messagepack-rs' to see if version <= 0.7.0 is usedCheck Version:
cargo tree | grep messagepack-rsVerify Fix Applied:
Verify messagepack-rs version is >= 0.8.0 in Cargo.lock and rebuild application📡 Detection & Monitoring
Log Indicators:
- Application crashes during MessagePack deserialization
- Unexpected memory access errors in Rust panic logs
Network Indicators:
- Unusual MessagePack traffic patterns
- Large or malformed MessagePack payloads
SIEM Query:
source="application_logs" AND ("panic" OR "abort") AND "messagepack"🔗 References
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/messagepack-rs/RUSTSEC-2021-0092.md
- https://rustsec.org/advisories/RUSTSEC-2021-0092.html
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/messagepack-rs/RUSTSEC-2021-0092.md
- https://rustsec.org/advisories/RUSTSEC-2021-0092.html
