PT-2018-9534 · Rust+1 · Rust Programming Language Standard Library+1

Publicado 2018-09-29 · Atualizado 2019-01-04 · CVE-2018-1000810

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Rust Programming Language Standard Library versions 1.27.1 through 1.29.0 The Rust Programming Language Standard Library version 1.27.2 The Rust Programming Language Standard Library version 1.28.0 The Rust Programming Language Standard Library versions 126.0 through 126.2 The Rust Programming Language Standard Library version 127.0

Description The issue is related to an integer overflow to buffer overflow in the standard library, which can result in a buffer overflow. This can be exploited via the str::repeat function, passed a large number, causing an internal buffer overflow.

Recommendations For version 1.27.1, update to version 1.29.1 or later. For version 1.27.2, update to version 1.29.1 or later. For version 1.28.0, update to version 1.29.1 or later. For versions 126.0 through 126.2, update to version 1.29.1 or later. For version 127.0, update to version 1.29.1 or later. As a temporary workaround, consider avoiding the use of the str::repeat function with large numbers until a patch is available.

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALT-PU-2018-2401

CVE-2018-1000810

MGASA-2018-0407

Produtos afetados

Alt Linux

Rust Programming Language Standard Library

Referências · 13

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000810 · Nota de Segurança
• https://groups.google.com/forum/#%21topic/rustlang-security-announcements/CmSuTm-SaU0 · Nota
• https://errata.altlinux.org/ALT-PU-2018-2401 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2018-0407 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=23701 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000810 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000810 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2018-0407.html · Nota de Segurança
• https://blog.rust-lang.org/2018/09/21/Security-advisory-for-std.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000810 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201812-11 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-1000810 · Aviso do Fabricante
• https://packages.altlinux.org/ru/vuln/CVE-2018-1000810 · Nota