CVE-2021-45707

Published: Dec 27, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.

Affected (3)

Products: Nix Project: Nix

Nix Project

1 product

Nix

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Nix Project Nix	From 0.16.0 to 0.20.2
Nix Project Nix	From 0.21.0 to 0.21.2
Nix Project Nix	From 0.22.0 to 0.22.2

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (6)

https://github.com/advisories/GHSA-wgrg-5h56-jg27

Source: cve@mitre.org

Third Party Advisory

https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nix/RUSTSEC-2021-0119.md

Source: cve@mitre.org

Third Party Advisory

https://rustsec.org/advisories/RUSTSEC-2021-0119.html

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://github.com/advisories/GHSA-wgrg-5h56-jg27

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/nix/RUSTSEC-2021-0119.md

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://rustsec.org/advisories/RUSTSEC-2021-0119.html

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.