CVE-2021-45707 is a critical out-of-bounds write vulnerability affecting the nix crate versions 0.16.0 through 0.20.1, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. Specifically, the unistd::getgrouplist function can write beyond allocated memory if a user belongs to more than 16 groups in /etc/groups. This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a severe risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score is 79/100, further emphasizing its high severity. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.16.0, < 0.20.2CPE matchmatch criteria | cpe:2.3:a:nix_project:nix:*:*:*:*:*:rust:*:* | ||
>= 0.21.0, < 0.21.2CPE matchmatch criteria | cpe:2.3:a:nix_project:nix:*:*:*:*:*:rust:*:* | ||
>= 0.22.0, < 0.22.2CPE matchmatch criteria | cpe:2.3:a:nix_project:nix:*:*:*:*:*:rust:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2021-45707
Sep 10, 2024Out-of-bounds Write in nix
Jan 6, 2022An issue was discovered in the nix crate 0.16.0 and later before 0.20.2 0.21.x before 0.21.2 and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
Dec 14, 2021