Security readout for executives and security teams
Plain-English summary
This affects Rust applications using the raw-cpuid crate before 9.1.1 only when the non-default serialize feature is enabled. A deserialization path may not validate data enough, causing a crash or memory corruption. Exposure appears narrow, but affected critical services should upgrade promptly.
Executive priority
Treat this as a targeted dependency hygiene issue, not an enterprise-wide emergency based on current evidence. Prioritize systems where Rust services use raw-cpuid with serialize enabled and process untrusted serialized data.
Technical view
CVE-2021-45687 is a validation flaw in raw-cpuid Deserialize handling when the serialize feature is enabled. The source describes possible memory corruption or panic. The affected range is before 9.1.1. No CVSS, CWE, exploit status, or detailed attack preconditions are provided.
Likely exposure
Likely limited to Rust projects that depend on raw-cpuid before 9.1.1 and enable the serialize feature. The bundle states this feature is not the default. Projects using default features only, or version 9.1.1 or later, are not indicated as affected by the supplied sources.
Exploitation context
The supplied sources do not show active exploitation, and KEV is false. Practical risk depends on whether an attacker can influence data passed into affected Deserialize operations. The public bundle does not define remote, local, privilege, or sandbox escape conditions.
Researcher notes
Evidence is sparse. The strongest facts are the affected version range, non-default feature condition, and possible memory corruption or panic. No exploit reports, CVSS vector, CWE, or operational workaround beyond upgrading or disabling serialize are provided in the bundle.
Mitigation direction
- Upgrade raw-cpuid to version 9.1.1 or later.
- Disable the serialize feature if it is not required.
- Avoid deserializing untrusted raw-cpuid data until reviewed.
- Check transitive dependencies for pinned vulnerable versions.
- Monitor RustSec and CVE records for updated guidance.
Validation and detection
- Inspect Cargo.lock for raw-cpuid versions before 9.1.1.
- Confirm whether the serialize feature is enabled.
- Review code paths that deserialize raw-cpuid types.
- Check SBOMs for direct or transitive raw-cpuid usage.
- Retest affected Rust services after dependency updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-45687 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://rustsec.org/advisories/RUSTSEC-2021-0089.htmlCVE reference · x_refsource_MISC
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/raw-cpuid/RUSTSEC-2021-0089.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.