CVE-2021-32810 - CVE House

Back to Database

Status published Critical CVE-2021-32810

Data race in crossbeam-deque

9.8 CVSS

Vulnerability Description

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32810

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from crossbeam-rs

View All →

Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils

Undefined Behavior in bounded Crossbeam channel

Affected Vendor

crossbeam-rs

View all reports →

Affected Software

crossbeam

Vulnerable Versions:

< 0.7.4, >= 0.8.0, < 0.8.1

Timeline

Official Publish: August 2nd, 2021

Last Modified: August 3rd, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1574 Hijack Execution Flow

T1565 Data Manipulation

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application