Integer Overflow in Rust's Zip Library Can Lead to Buffer Overflow
CVE-2021-28879
9.8CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2021-28879?
The Zip implementation within Rust's standard library, prior to version 1.52.0, contains a flaw that can manifest as an integer overflow when processing Zip file sizes. This can result in the library returning an erroneous size, which may ultimately lead to a buffer overflow vulnerability if a Zip iterator that has already been consumed is reused. Consequently, this issue poses significant security risks, making it essential for users to update to the patched version to mitigate potential exploits.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.