CVE-2021-27378 is a critical vulnerability in the rand_core Rust crate, affecting versions prior to 0.6.2. It stems from improper buffer-length checks in the read_u32_into and read_u64_into functions, potentially leading to random number generators being seeded with insufficient data. With a CVSS score of 9.8 (CRITICAL), this vulnerability is remotely exploitable with low attack complexity, allowing for complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.6.0, < 0.6.2CPE matchmatch criteria | cpe:2.3:a:rand_core_project:rand_core:*:*:*:*:*:rust:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2021-27378
Jun 11, 2024Incorrect check on buffer length in rand_core
Aug 25, 2021An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks a random number generator may be seeded with too little data.
Feb 9, 2021