PT-2019-14269 · Rust · Memoffset

Publicado 2019-07-16 · Atualizado 2021-08-25 · CVE-2019-15553

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions memoffset crate versions prior to 0.5.0

Description An issue in the memoffset crate can cause exposure of uninitialized memory. The affected versions of this crate can lead to traps and/or memory unsafety by zero-initializing references. Additionally, they can cause uninitialized memory to be dropped if the field for which the offset is requested was behind a deref coercion, and that deref coercion caused a panic. The flaw was corrected by using MaybeUninit.

Recommendations For versions prior to 0.5.0, update to version 0.5.0 or later to resolve the issue. As a temporary workaround, consider using MaybeUninit to prevent uninitialized memory exposure until the update is applied.

Correção

Use of Uninitialized Resource

Enumeração de Fraquezas

CWE-908

Identificadores relacionados

CVE-2019-15553

GHSA-RH89-X75F-RH3C

RUSTSEC-2019-0011

Produtos afetados

Memoffset

Referências · 13

• https://github.com/Gilnaa/memoffset/issues/9#issuecomment-505461490 · Nota
• https://github.com/Gilnaa/memoffset · Nota
• https://rustsec.org/advisories/RUSTSEC-2019-0011.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-15553 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-15553 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-15553 · Aviso do Fabricante
• https://crates.io/crates/memoffset · Nota
• https://cve.org/CVERecord?id=CVE-2019-15553 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15553 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-15553 · Aviso do Fabricante
• https://osv.dev/vulnerability/RUSTSEC-2019-0011 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rh89-x75f-rh3c · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15553 · Nota de Segurança