PT-2019-14538 · Renderdoc · Renderdoc

Publicado 2019-09-02 · Atualizado 2021-08-25 · CVE-2019-16142

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions renderdoc crate versions prior to 0.5.0

Description The issue arises from methods in the renderdoc crate that take self by immutable reference, which is incompatible with multi-threaded applications and can lead to unexpected behavior when called without synchronization. This technically unsound behavior can result in unpredictable outcomes.

Recommendations For versions prior to 0.5.0, update to release 0.5.0 to resolve the issue. As a temporary workaround, consider synchronizing access to methods that take self by immutable reference to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2019-16142

GHSA-VHFR-V4W9-45V8

RUSTSEC-2019-0018

Produtos afetados

Renderdoc

Referências · 8

• https://github.com/ebkalderon/renderdoc-rs/pull/32 · Correção
• https://github.com/ebkalderon/renderdoc-rs · Nota
• https://osv.dev/vulnerability/RUSTSEC-2019-0018 · Aviso do Fabricante
• https://rustsec.org/advisories/RUSTSEC-2019-0018.html · Nota
• https://osv.dev/vulnerability/CVE-2019-16142 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vhfr-v4w9-45v8 · Aviso do Fabricante
• https://crates.io/crates/renderdoc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16142 · Nota de Segurança