PT-2018-15488 · Rust · Slice-Deque
Publicado
2018-12-05
·
Atualizado
2021-08-25
·
CVE-2018-20995
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
slice-deque crate versions prior to 0.1.16
Description
An issue in the slice-deque crate allows memory corruption due to mishandled deque updates. Specifically, when the tail of the deque is in the mirrored memory region before insertion or removal and the head is exactly at the beginning of the mirrored memory region after the operation, the deque's head and tail are not properly updated. This can lead to a corrupted state where an attacker could exploit the issue to alter program execution by causing partial reads and writes, reading uninitialized memory, or accessing memory containing previously dropped objects.
Recommendations
For versions prior to 0.1.16, update to version 0.1.16 or later to properly update the head and tail of the deque and prevent memory corruption.
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Slice-Deque