PT-2019-14270 · Rust · Smallvec

Publicado 2019-07-19 · Atualizado 2021-08-25 · CVE-2019-15554

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions smallvec crate versions prior to 0.6.10

Description The issue is related to memory corruption that occurs when attempting to call grow on a spilled SmallVec with a value less than the current capacity. This can cause corruption of memory allocator data structures. An attacker controlling the value passed to grow may exploit this flaw to obtain memory contents or gain remote code execution.

Recommendations For versions prior to 0.6.10, update to version 0.6.10 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the grow function on spilled SmallVec instances with values less than the current capacity until a patch is applied.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2019-15554

GHSA-69GW-HGJ3-45M7

RUSTSEC-2019-0012

Produtos afetados

Smallvec

Referências · 10

• https://github.com/servo/rust-smallvec/issues/149 · Correção
• https://github.com/servo/rust-smallvec · Nota
• https://rustsec.org/advisories/RUSTSEC-2019-0012.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-15554 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-15554 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15554 · Nota de Segurança
• https://osv.dev/vulnerability/RUSTSEC-2019-0012 · Aviso do Fabricante
• https://crates.io/crates/smallvec · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-15554 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-69gw-hgj3-45m7 · Aviso do Fabricante