Race Condition Affecting thunderbird package, versions <0:91.2.0-1.el8_4


Severity

Recommended
high

Based on Rocky Linux security rating.

Threat Intelligence

EPSS
1.15% (85th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Race Condition vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ROCKY8-THUNDERBIRD-3287305
  • published3 Feb 2023
  • disclosed2 Aug 2021

Introduced: 2 Aug 2021

CVE-2021-32810  (opens in a new tab)
CWE-362  (opens in a new tab)

How to fix?

Upgrade Rocky-Linux:8 thunderbird to version 0:91.2.0-1.el8_4 or higher.
This issue was patched in RLSA-2021:3838.

NVD Description

Note: Versions mentioned in the description apply only to the upstream thunderbird package and not the thunderbird package as distributed by Rocky-Linux. See How to fix? for Rocky-Linux:8 relevant fixed versions and status.

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using Stealer::steal, Stealer::steal_batch, or Stealer::steal_batch_and_pop are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.

References

CVSS Scores

version 3.1