Data race in crossbeam-deque
Priority MEDIUM 46CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 9 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.
Why it matters now
EPSS 0.01907 79th percentileScored 2026-11-07
Fix Partial crossbeam (crossbeam-rs): 0.7.4, 0.8.1crossbeam-deque (crates.io): 0.7.4, 0.8.1Red Hat: 8 advisoriesRed Hat: 9 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| crossbeam-rs | crossbeam | before 0.7.4; 0.8.0 to before 0.8.1 | 0.7.4, 0.8.1 | Patch available | CNA |
| — | crossbeam-deque (crates.io) | before 0.7.4 | 0.7.4 | Patch available | GHSA-pqqp-xmhj-wgcw |
| — | crossbeam-deque (crates.io) | 0.8.0 to before 0.8.1 | 0.8.1 | Patch available | GHSA-pqqp-xmhj-wgcw |
- crossbeam Vendorcrossbeam-rs Affected before 0.7.4; 0.8.0 to before 0.8.1 Fixed in 0.7.4, 0.8.1 Patch available CNA
- crossbeam-deque (crates.io) Vendor— Affected before 0.7.4 Fixed in 0.7.4 Patch available GHSA-pqqp-xmhj-wgcw
- crossbeam-deque (crates.io) Vendor— Affected 0.8.0 to before 0.8.1 Fixed in 0.8.1 Patch available GHSA-pqqp-xmhj-wgcw
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:crossbeam_project:crossbeam:*:*:*:*:*:*:*:* | before 0.7.4; 0.8.0 to before 0.8.1 | Vulnerable | crossbeam-rs |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
- cpe:2.3:a:crossbeam_project:crossbeam:*:*:*:*:*:*:*:* Versions before 0.7.4; 0.8.0 to before 0.8.1 Vulnerable ·crossbeam-rs
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA crossbeam (crossbeam-rs) Fixed in 0.7.4, 0.8.1
- Fix · GHSA-pqqp-xmhj-wgcw crossbeam-deque (crates.io) Fixed in 0.7.4 Advisory →
- Fix · GHSA-pqqp-xmhj-wgcw crossbeam-deque (crates.io) Fixed in 0.8.1 Advisory →
Red Hat 8 advisories
- RHSA-2021:3841 Released 2021-10-13 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux Client (v. 7) thunderbird-91.2.0-1.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-91.2.0-1.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-91.2.0-1.el7_9
- RHSA-2021:3838 Released 2021-10-13 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream (v. 8) thunderbird-91.2.0-1.el8_4
- RHSA-2021:3839 Released 2021-10-13 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) thunderbird-91.2.0-1.el8_2
Show 5 more Red Hat advisories
- RHSA-2021:3840 Released 2021-10-13 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) thunderbird-91.2.0-1.el8_1
- RHSA-2021:3791 Released 2021-10-12 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux Client (v. 7) firefox-91.2.0-4.el7_9
- Red Hat Enterprise Linux Client Optional (v. 7) firefox-91.2.0-4.el7_9
- Red Hat Enterprise Linux Server (v. 7) firefox-91.2.0-4.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) firefox-91.2.0-4.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) firefox-91.2.0-4.el7_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-91.2.0-4.el7_9
- RHSA-2021:3755 Released 2021-10-11 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream (v. 8) firefox-91.2.0-4.el8_4
- RHSA-2021:3757 Released 2021-10-11 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) firefox-91.2.0-4.el8_1
- RHSA-2021:3756 Released 2021-10-11 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) firefox-91.2.0-4.el8_2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:3755, RHSA-2021:3838 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2021:3757, RHSA-2021:3840 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | RHSA-2021:3756, RHSA-2021:3839 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2021:3791, RHSA-2021:3841 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2021:3791 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3791 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2021:3791, RHSA-2021:3841 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3791, RHSA-2021:3841 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2021:3791 |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32810
- 2026-10-03 Alias added: GHSA-pqqp-xmhj-wgcw
References
Advisory 16
- https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw
- FEDORA-2021-a5161737c3
- FEDORA-2021-537541ceae
- FEDORA-2021-5e99655cca
- FEDORA-2021-2db6c84087
- FEDORA-2021-60f0e1bb35
- FEDORA-2021-3cf88e44b4
- FEDORA-2021-67d6c34e5b
- FEDORA-2021-32c9adf002
- FEDORA-2021-e37a366b00
- FEDORA-2021-af2eb94426
- FEDORA-2021-9dc0bd0072
- FEDORA-2021-0f82e9d6d5
- FEDORA-2021-e5ec6d55bf
- FEDORA-2021-79ce3cb64a
- https://nvd.nist.gov/vuln/detail/CVE-2021-32810
Other 16
- https://rustsec.org/advisories/RUSTSEC-2021-0093.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZQDIBB7VR3ER52FMSMNJPAWNDO5SITCE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XFBZWCLG7AGLJO4A7K5IMJVPLSWZ5TJP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WGB2H35CTZDHOV3VLC5BM6VFGURLLVRP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VQZIEJQBV3S72BHD5GKJQF3NVYNRV5CF
- https://lists.fedoraproject.org/archives/list/[email protected]/message/U3LSN3B43TJSFIOB3QLPBI3RCHRU5BLO
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TFUBWBYCPSSXTJGEAQ67CJUNQJBOCM26
- https://lists.fedoraproject.org/archives/list/[email protected]/message/RRPKBRXCRNGNMVFQPFD4LM3QKPEMBQQR
- https://lists.fedoraproject.org/archives/list/[email protected]/message/OCLMH7B7B2MF55ET4NQNPH7JWISFX4RT
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LCIBFGBSL3JSVJQTNEDEIMZGZF23N2KE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/EW5B2VTDVMJ6B3DA4VLMAMW2GGDCE2BK
- https://lists.fedoraproject.org/archives/list/[email protected]/message/CY5T3FCE4MUYSPKEWICLVJBBODGJ6SZE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AYBSLIYFANZLCYWOGTIYZUM26TJRH7WU
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AWHNNBJCU4EHA2X5ZAMJMGLDUYS5FEPP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7EZILHZDRGDPOBQ4KTW3E5PPMKLHGH5N
- https://github.com/crossbeam-rs/crossbeam
More crossbeam-rs Crossbeam vulnerabilities
- TI-2022-07691 Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils CVSS 3.1HIGH 8.1
- TI-2020-12026 Undefined Behavior in bounded Crossbeam channel CVSS 3.1CRITICAL 9.8
- TI-2018-14958 An issue was discovered in the crossbeam crate before 0.4.1 for Rust. CVSS 3.0CRITICAL 9.8
Sources
- CVE-2021-32810 · CVE Program
- CVE-2021-32810 · NVD
- FIRST EPSS
- GHSA-pqqp-xmhj-wgcw · GitHub Advisory Database · CC BY 4.0
- CVE-2021-32810 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences