PT-2018-15491 · Rust+1 · Rust+1

Publicado 2018-12-18 · Atualizado 2021-08-25 · CVE-2018-20998

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions arrayfire versions prior to 3.6.0

Description The issue is related to the addition of the repr() attribute to an enum, which is mishandled and leads to memory corruption. This problem occurs when using the MSVC toolchain and is interlinked with the version of Rust being used. The issue started to appear since Rust version 1.28.

Recommendations For arrayfire versions prior to 3.6.0, update to version 3.6.0 to resolve the issue. As a temporary workaround, consider using Rust versions 1.27 or earlier with arrayfire crates version 3.5.0 or earlier.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2018-20998

GHSA-69FV-GW6G-8CCG

PYSEC-2019-144

RUSTSEC-2018-0011

Produtos afetados

Rust

Arrayfire

Referências · 12

• https://github.com/arrayfire/arrayfire-rust · Nota
• https://github.com/arrayfire/arrayfire-rust/commit/a5256f3e5e23b83eaad69699e0b04653aba04fb8 · Nota
• https://github.com/arrayfire/arrayfire-rust/pull/177 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/arrayfire/PYSEC-2019-144.yaml · Nota
• https://github.com/advisories/GHSA-69fv-gw6g-8ccg · Nota
• https://osv.dev/vulnerability/PYSEC-2019-144 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-69fv-gw6g-8ccg · Aviso do Fabricante
• https://crates.io/crates/arrayfire · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-20998 · Nota de Segurança
• https://osv.dev/vulnerability/RUSTSEC-2018-0011 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-20998 · Aviso do Fabricante
• https://rustsec.org/advisories/RUSTSEC-2018-0011.html · Nota