PT-2019-16421 · Rust · Flatbuffers

Publicado 2019-10-20 · Atualizado 2021-08-25 · CVE-2019-25004

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions flatbuffers crate versions prior to 0.6.1

Description An issue in the flatbuffers crate for Rust allows arbitrary bytes to be reinterpreted as a bool, defeating soundness. The implementation of impl Follow for bool enables this reinterpretation, violating the stringent requirements for the in-memory representation of bool in Rust and potentially invoking undefined behavior in safe code.

Recommendations For versions prior to 0.6.1, update to version 0.6.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the impl Follow for bool function to minimize the risk of exploitation.

Exploit

Correção

Incorrect Type Conversion or Cast

Enumeração de Fraquezas

CWE-704

Identificadores relacionados

CVE-2019-25004

GHSA-GX73-2498-R55C

RUSTSEC-2019-0028

Produtos afetados

Flatbuffers

Referências · 10

• 🔥 https://rustsec.org/advisories/RUSTSEC-2019-0028.html · Exploit
• https://github.com/google/flatbuffers · Nota
• https://github.com/google/flatbuffers/issues/5530 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25004 · Nota de Segurança
• https://crates.io/crates/flatbuffers · Nota
• https://osv.dev/vulnerability/RUSTSEC-2019-0028 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-25004 · Aviso do Fabricante
• https://t.me/cibsecurity/21459 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-gx73-2498-r55c · Aviso do Fabricante
• https://t.me/cvenotify/8020 · Publicação no Telegram