PT-2019-14535 · Rust · Compact Arena Crate
Cad97
·
Publicado
2019-05-21
·
Atualizado
2021-08-25
·
CVE-2019-16139
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
compact arena crate versions prior to 0.4.0
Description
An issue in the compact arena crate for Rust involves the mishandling of generativity, leading to potential out-of-bounds writes or reads. The affected versions did not properly implement generativity because invariant lifetimes were not necessarily dropped. This allows an attacker to mix up two arenas, using indices created from one arena with another, potentially leading to out-of-bounds read or write access into the memory reserved for the arena.
Recommendations
For versions prior to 0.4.0, update to version 0.4.0 to resolve the issue, as it correctly implements generativity.
Correção
Out of bounds Read
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Compact Arena Crate