CVE-2021-45707
📋 TL;DR
This vulnerability in the nix Rust crate allows an out-of-bounds write when a user belongs to more than 16 groups in /etc/groups. Attackers could exploit this to execute arbitrary code or crash applications. Any Rust application using affected nix crate versions is vulnerable.
💻 Affected Systems
- nix Rust crate
📦 What is this software?
Nix by Nix Project
Nix by Nix Project
Nix by Nix Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, privilege escalation, or denial of service.
Likely Case
Application crashes (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
No impact if patched versions are used or if users have ≤16 groups.
🎯 Exploit Status
Exploitation requires triggering the specific condition with >16 groups, but no public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.20.2, 0.21.2, 0.22.2 or later
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2021-0119.html
Restart Required: Yes
Instructions:
1. Update Cargo.toml to use nix >=0.20.2, >=0.21.2, or >=0.22.2. 2. Run 'cargo update'. 3. Rebuild and redeploy your application. 4. Restart affected services.
🔧 Temporary Workarounds
Limit user groups
linuxEnsure no users belong to more than 16 groups in /etc/groups
grep '^[^:]*:[^:]*:[^:]*:[^:]*,[^:]*,[^:]*,[^:]*,[^:]*,[^:]*,[^:]*,[^:]*,[^:]*,[^:]*,[^:]*,[^:]*,[^:]*,[^:]*' /etc/group
🧯 If You Can't Patch
- Isolate affected applications in containers or VMs with limited privileges
- Implement strict network controls to limit exposure to untrusted inputs
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock for nix crate versions 0.16.0-0.20.1, 0.21.0-0.21.1, or 0.22.0-0.22.1Check Version:
grep -A2 'name = "nix"' Cargo.lockVerify Fix Applied:
Verify Cargo.lock contains nix >=0.20.2, >=0.21.2, or >=0.22.2📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Unexpected memory access errors in Rust applications
Network Indicators:
- Unusual outbound connections from Rust applications after crashes
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "out of bounds" OR "nix crate")🔗 References
- https://github.com/advisories/GHSA-wgrg-5h56-jg27
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nix/RUSTSEC-2021-0119.md
- https://rustsec.org/advisories/RUSTSEC-2021-0119.html
- https://github.com/advisories/GHSA-wgrg-5h56-jg27
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nix/RUSTSEC-2021-0119.md
- https://rustsec.org/advisories/RUSTSEC-2021-0119.html
