From unknown Sat Jun 14 03:48:06 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#47544 <47544@debbugs.gnu.org> To: bug#47544 <47544@debbugs.gnu.org> Subject: Status: rust-slice-deque is vulnerable to CVE-2021-29938 Reply-To: bug#47544 <47544@debbugs.gnu.org> Date: Sat, 14 Jun 2025 10:48:06 +0000 retitle 47544 rust-slice-deque is vulnerable to CVE-2021-29938 reassign 47544 guix submitter 47544 L=C3=A9o Le Bouter severity 47544 normal tag 47544 security thanks From debbugs-submit-bounces@debbugs.gnu.org Thu Apr 01 10:09:03 2021 Received: (at submit) by debbugs.gnu.org; 1 Apr 2021 14:09:03 +0000 Received: from localhost ([127.0.0.1]:58134 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lRy0M-0007Uu-Pt for submit@debbugs.gnu.org; Thu, 01 Apr 2021 10:09:03 -0400 Received: from lists.gnu.org ([209.51.188.17]:38944) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lRy0L-0007UY-8R for submit@debbugs.gnu.org; Thu, 01 Apr 2021 10:09:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:52690) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lRy0L-0006Ip-3p for bug-guix@gnu.org; Thu, 01 Apr 2021 10:09:01 -0400 Received: from mail.zaclys.net ([178.33.93.72]:43847) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lRy0I-0003Sa-Ot for bug-guix@gnu.org; Thu, 01 Apr 2021 10:09:00 -0400 Received: from guix-xps.local (lsl43-1_migr-78-195-19-20.fbx.proxad.net [78.195.19.20] (may be forged)) (authenticated bits=0) by mail.zaclys.net (8.14.7/8.14.7) with ESMTP id 131E8urC056368 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 1 Apr 2021 16:08:56 +0200 DMARC-Filter: OpenDMARC Filter v1.3.2 mail.zaclys.net 131E8urC056368 Authentication-Results: mail.zaclys.net; dmarc=fail (p=reject dis=none) header.from=zaclys.net Authentication-Results: mail.zaclys.net; spf=fail smtp.mailfrom=lle-bout@zaclys.net DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zaclys.net; s=default; t=1617286136; bh=yHO7BAff055BDHmGQS1tS4AImiqz+awF5Q/76yqiR5k=; h=Subject:From:To:Date:From; b=lufg7wY+z6wAXJ5O95rd10JAYRmPwQcsiyEYJqJCRI9sX5wYXaSMplM+oP0QexEMr Zo2dz10noyOcqyubhEbQkqd7diUCWKZ6UW7sBk71KUR6Z1HWue0TbyLEHTLGCNGDlv an+BL8N+7jQrYHH0k2HeyzIAvwyEc5Z8mis4OjK8= Message-ID: <3e2016e62239d2039e48c945a6b6a982c09e3f5f.camel@zaclys.net> Subject: rust-slice-deque is vulnerable to CVE-2021-29938 From: =?ISO-8859-1?Q?L=E9o?= Le Bouter To: bug-guix@gnu.org Date: Thu, 01 Apr 2021 16:08:47 +0200 Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-CmySpdBTHTGrLBWbcIAv" User-Agent: Evolution 3.34.2 MIME-Version: 1.0 Received-SPF: pass client-ip=178.33.93.72; envelope-from=lle-bout@zaclys.net; helo=mail.zaclys.net X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Spam-Score: 1.4 (+) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: CVE-2021-29938 07:15 An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate function. Upstream PR: https://github.com/gnzlbg/slice_deque/pull/91 Content analysis details: (1.4 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [209.51.188.17 listed in list.dnswl.org] 0.0 RCVD_IN_MSPIKE_H4 RBL: Very Good reputation (+4) [209.51.188.17 listed in wl.mailspike.net] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record 1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) 0.0 RCVD_IN_MSPIKE_WL Mailspike good senders 2.7 MAY_BE_FORGED Relay IP's reverse DNS does not resolve to IP X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -2.3 (--) --=-CmySpdBTHTGrLBWbcIAv Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable CVE-2021-29938 07:15 An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate function. Upstream PR: https://github.com/gnzlbg/slice_deque/pull/91 I suggest we wait for merge then update our package. --=-CmySpdBTHTGrLBWbcIAv Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEFIvLi9gL+xax3g6RRaix6GvNEKYFAmBl0+8ACgkQRaix6GvN EKaK6g/+Mz00XfGipOQkZnxHNCMeyow+SRlAUQbZKJCPKCuFjPTszW1075c9YCCd dcJ9/cdESVmodrlGcay5+qHqXbPQCLMwvT5+FpVB3/gn0NrybueHhm34jswbNB5d mBKPuZWTSpuWyvLhb2xTKVZPlNducPev6jcj68vVP9/PEknOkJ/luFLVNb1b38Fa HlkVaAZ908Wecx9wstji7F3lW4TVENxnMgrndoKBAJyDTGuOr3hj5Y2aT2tVsCGp MVKbjIlr+ydSgfTKOe0KnC2gztPNBf9cd7DwTnQgim4XdujB23iLI99KWUej3Snv SNbfrCyDzpofHMbNgxlM1drRiMwRr44D27dSIqGtlyjmoW8/3ug3GEIjubf8PEw6 8TMT/OZM1Uuz85x6BHb5iPSKJqOTWxX51DbR462zLfbPmj1hyYVh2ztPJG/Llv6a V0EVVCgPcpiIiJ+jRq1DF1465VQLvb838Jzp1SYdCUXJAYFMQzvjeeC8najh2RGG XNlpkOVLQbiJkZ5b2cGjRX1XL4rDQ5cJQUiGZiKGg7AsVq4lg4fUNVFwzTUcFI4W 8sRBYjsKb9Jxfswl0IOXzwxzCNIz6CciDjMtJb39l1cop8FYF1B9V5J5myQ5RGy2 cee7OijCNnfVo90W1JbCAB7LMFj1kQCt+4Xdj5n8Q9MZy8buhz4= =cx4d -----END PGP SIGNATURE----- --=-CmySpdBTHTGrLBWbcIAv-- From debbugs-submit-bounces@debbugs.gnu.org Thu Apr 01 10:09:53 2021 Received: (at control) by debbugs.gnu.org; 1 Apr 2021 14:09:53 +0000 Received: from localhost ([127.0.0.1]:58143 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lRy1B-0007Wx-4N for submit@debbugs.gnu.org; Thu, 01 Apr 2021 10:09:53 -0400 Received: from mail.zaclys.net ([178.33.93.72]:51955) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lRy19-0007We-Rj for control@debbugs.gnu.org; Thu, 01 Apr 2021 10:09:52 -0400 Received: from guix-xps.local (lsl43-1_migr-78-195-19-20.fbx.proxad.net [78.195.19.20] (may be forged)) (authenticated bits=0) by mail.zaclys.net (8.14.7/8.14.7) with ESMTP id 131E9j1P056496 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 1 Apr 2021 16:09:45 +0200 DMARC-Filter: OpenDMARC Filter v1.3.2 mail.zaclys.net 131E9j1P056496 Authentication-Results: mail.zaclys.net; dmarc=fail (p=reject dis=none) header.from=zaclys.net Authentication-Results: mail.zaclys.net; spf=fail smtp.mailfrom=lle-bout@zaclys.net DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zaclys.net; s=default; t=1617286185; bh=4dGyAnlonCImVWRdMUcJGKeMBAOjIuaqfZCr+Hq7Y1A=; h=Subject:From:To:Date:From; b=GcJIo9PosUlcYEgkgJMNH+Shf/uJVam6mkeOffHvNlS8oH9+W5MDkCC/CMoObRTp3 jeJSK8EE4H9nQkK3dLZlYERYuyt4nZZUbB7EXByXwAKmXvd4vuoBiHQcT8XoRET6x8 ellkkGhB9vOuBo10+BkXJ19g4UBq72+Ll4fasIec= Message-ID: <455f913579bf510bb21c651880a53dda55c7be9e.camel@zaclys.net> Subject: From: =?ISO-8859-1?Q?L=E9o?= Le Bouter To: control@debbugs.gnu.org Date: Thu, 01 Apr 2021 16:09:45 +0200 Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-AEzuyI3Q67GS4cjPfeBh" User-Agent: Evolution 3.34.2 MIME-Version: 1.0 X-Spam-Score: 2.0 (++) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: tags 47544 + security quit Content analysis details: (2.0 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 2.0 BLANK_SUBJECT Subject is present but empty X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 1.0 (+) --=-AEzuyI3Q67GS4cjPfeBh Content-Type: text/plain Content-Transfer-Encoding: quoted-printable tags 47544 + security quit --=-AEzuyI3Q67GS4cjPfeBh Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEFIvLi9gL+xax3g6RRaix6GvNEKYFAmBl1CkACgkQRaix6GvN EKYqIg//fEcUdfGmcvqLlJqL+2OQpLOG3Q7eLH+Js3txTX0iAqt+koJBhmMicOg7 kW0peiGvHwAfNiGgT2Lq9cR9TezAREQk2I0TeW+HpB+2vPB4RAacCXTx76FXlO/c 5i7+y2P99FR/9eX9DSvVdmIJ1Q4eN5BxNmhqgB6P+SzQYotPvbyX+pUJb3wiXCLS cW9Wxg997oclQXcpoKC9DRkmJXhoYiGOFdXfq9IdS3OMJiC2AOTIPW+Wpvg2jAvk iJLREjI77AlImK2Vg7IzpHC+ndMCJTe883W5Fuuvphc2zF7sZ8zKTLEicAqIA991 TtIakdKoJ/8fkltESeTw+RKw1ow/NFA6BoHzh2TNSzimSFMYTL3gF1l2OfwHRYwu mMyAV05uTwl1TfZ1PUecgUp94UM9PfA1fz7FoUJVyTkLN7jvl67ITC7SkFY4RVG8 8LjOzTUfMLS95JnAOt17K36C3fZEZSc06XVqIauiriBA3osrYjVYGNUo97GH7Xrz YcFsYWNgnyEScbDkbMRcmndrThWxbwpBvrJL9BCJ8H/JJU5CGEbALu56qEXBgiea szxvziPWLQkRLIiQ7WejpLR4e+z74/SV4Lnleekb8zqwusWqy37o/C1HT40KhzJS nOVMEtlMK2lJLeYkAUMor7yQFZKZmhlmqkDVMgUu0tEHORUfFnA= =vIVe -----END PGP SIGNATURE----- --=-AEzuyI3Q67GS4cjPfeBh-- From debbugs-submit-bounces@debbugs.gnu.org Tue Mar 22 22:39:20 2022 Received: (at 47544) by debbugs.gnu.org; 23 Mar 2022 02:39:20 +0000 Received: from localhost ([127.0.0.1]:42295 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nWqu7-0000o3-RO for submit@debbugs.gnu.org; Tue, 22 Mar 2022 22:39:20 -0400 Received: from mail-qv1-f52.google.com ([209.85.219.52]:36702) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nWqu6-0000nq-E2 for 47544@debbugs.gnu.org; Tue, 22 Mar 2022 22:39:18 -0400 Received: by mail-qv1-f52.google.com with SMTP id kc20so310583qvb.3 for <47544@debbugs.gnu.org>; Tue, 22 Mar 2022 19:39:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:references:date:in-reply-to:message-id :user-agent:mime-version:content-transfer-encoding; bh=VX0iAcDhsjnhMq/+vq5QJQOLhQIF7NNIOGGQ6++vOp4=; b=lsljRAdX6FdwN/qrxDKTZyOIEgKIyZFGrtjQj19p0IHHP9dIzENjifS6z5FXHiuJxG CgMMJzlw67J13ugNoRbI6/NfoCRabpb7X5vs5U00Ogx36I5BgjusHXzkrOUtvbIhy8kb D2bN/bTIngVL34YfzAqQM3g8o4WTn/uf4Rnnavzvi1GNp3dMEOQOH9MMSzNs5jlnRzZX jnt789BPn0gg2pxAd3oOKXHMpCLhfGrCVDct3Do2dfjH8ZhGAa/DAbdMxBp0bnbtgTVw OgMqW+GacRZ8nXV18uZ5Hpu8LgrIfF6V3kNA4Tc7bhC2BC3v4zyXYXP4d2Gjdc6mv/6F Sgqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:references:date:in-reply-to :message-id:user-agent:mime-version:content-transfer-encoding; bh=VX0iAcDhsjnhMq/+vq5QJQOLhQIF7NNIOGGQ6++vOp4=; b=ngOR11hxPo8cXjtSzUvmYKvgsIO/afA4XYpu+9V5mtxZAUew9YO8M1yxDfZhAq8G8D 6QYzBWDsz1el0W2KqFEo6ymj4/4hoyWZumOyOEHYMJ92tRdpa63WYHqYvRVFeFKtxZe0 0iAg3Q/ZFLIirixziZv+FTzJLRP+w7LGKG05TfrlAsYXRdhjvdGBwrciLSfwPLyvLlP2 LulMyszSKUstl7pc0rs8tIUSqxmv/jF1eHPNW9+ubhXRpPRoUzSW2BJpQx3Jd1LJ9TWE t8ToScdJeX5KYl80j6laD3UCikXhVdkGhi10kSm0062aRJBGGOvQnZfxxOqvxUFqifaT 3rkA== X-Gm-Message-State: AOAM5336hBTPtnoFZ2Ul48WnqQS1i5EEKYNhjuhxBpoxOn6VwUAfvG9l SXqZq5DY+HZMbMUW7CjLOiyJ9uXxTqE= X-Google-Smtp-Source: ABdhPJwnF5y9iCp/1+MeYn+JVFTZ1MstZ6WFTwCUF+hMAd4Dq3sttYvlqrDPcI6S1tZv0bhyYfPtaQ== X-Received: by 2002:a05:6214:4111:b0:440:ce1e:831f with SMTP id kc17-20020a056214411100b00440ce1e831fmr22146803qvb.56.1648003152777; Tue, 22 Mar 2022 19:39:12 -0700 (PDT) Received: from hurd (dsl-10-129-199.b2b2c.ca. [72.10.129.199]) by smtp.gmail.com with ESMTPSA id b202-20020ae9ebd3000000b0067b11d53365sm9909458qkg.47.2022.03.22.19.39.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 22 Mar 2022 19:39:12 -0700 (PDT) From: Maxim Cournoyer To: =?utf-8?Q?L=C3=A9o?= Le Bouter Subject: Re: bug#47544: rust-slice-deque is vulnerable to CVE-2021-29938 References: <3e2016e62239d2039e48c945a6b6a982c09e3f5f.camel@zaclys.net> Date: Tue, 22 Mar 2022 22:39:11 -0400 In-Reply-To: <3e2016e62239d2039e48c945a6b6a982c09e3f5f.camel@zaclys.net> (=?utf-8?Q?=22L=C3=A9o?= Le Bouter"'s message of "Thu, 01 Apr 2021 16:08:47 +0200") Message-ID: <87v8w5z92o.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 47544 Cc: 47544@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Hello, L=C3=A9o Le Bouter writes: > CVE-2021-29938 07:15 > An issue was discovered in the slice-deque crate through 2021-02-19 for > Rust. A double drop can occur in SliceDeque::drain_filter upon a panic > in a predicate function. > > Upstream PR: https://github.com/gnzlbg/slice_deque/pull/91 The project appears unmaintained [0]. [0] https://github.com/gnzlbg/slice_deque/issues/94. It's used by a couple other packages (how many? hard to tell, this being Rust in Guix). Thanks, Maxim