CVE-2021-45705
Aliased mutable references from `tls_rand` & `TlsWyRand`
An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
- Record
CVE-2021-45705- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
- Record
CVE-2021-45705- Updated
- 2026-11-02
EUVDEUVD-2022-0681 No score
An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
- Record
EUVD-2022-0681- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r57r-j98g-587f
Pointer dereference in nanorand
An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
- Record
GHSA-r57r-j98g-587f- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p6gj-gpc8-f8xw No score
Aliased mutable references from `tls_rand` & `TlsWyRand`
TlsWyRand's implementation of Deref unconditionally dereferences a raw pointer, and returns
multiple mutable references to the same object, which is undefined behavior.
- Record
GHSA-p6gj-gpc8-f8xw- Updated
- 2026-11-02
OSVGHSA-r57r-j98g-587f
Pointer dereference in nanorand
An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
- Record
GHSA-r57r-j98g-587f- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-p6gj-gpc8-f8xw No score
Aliased mutable references from `tls_rand` & `TlsWyRand`
TlsWyRand's implementation of Deref unconditionally dereferences a raw pointer, and returns
multiple mutable references to the same object, which is undefined behavior.
- Record
GHSA-p6gj-gpc8-f8xw- Updated
- 2026-11-02
OSVRUSTSEC-2021-0114 No score
Aliased mutable references from `tls_rand` & `TlsWyRand`
TlsWyRand's implementation of Deref unconditionally dereferences a raw pointer, and returns
multiple mutable references to the same object, which is undefined behavior.
- Record
RUSTSEC-2021-0114- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nanorandcrates.io |
0.5.0 up to 0.6.1 | 0.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-45705 is a critical vulnerability (CVSS 9.8) in Nanorand Project Nanorand, published September 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. Fixed in nanorand 0.6.1.
References
rustsec.org/advisories/RUSTSEC-2021-0114.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/nanorand/RUSTSEC-2021-0114.md
github.com/Absolucy/nanorand-rs/issues/28
nvd.nist.gov/vuln/detail/CVE-2021-45705
crates.io/crates/nanorand