PT-2019-14259 · Rust · Slice-Deque
Publicado
2019-05-07
·
Atualizado
2021-08-25
·
CVE-2019-15543
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
slice-deque crate versions prior to 0.2.0
Description
The issue is related to memory corruption in certain allocation cases. Affected versions of the crate can enter a corrupted state if the size of an element is not a multiple of the allocation granularity and a specific allocation pattern is used, allowing an attacker to corrupt the deque. This can result in undefined behavior, such as reading bytes from adjacent elements. The flaw was corrected by using a pair of pointers to track the head and tail of the deque instead of a pair of indices.
Recommendations
For versions prior to 0.2.0, update to version 0.2.0 or later, which uses a pair of pointers to track the head and tail of the deque, correcting the flaw.
Correção
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Slice-Deque