PT-2018-15484 · Rust+1 · Smallvec+1

Vurich · Published 2018-07-19 · Updated 2021-08-25 · CVE-2018-20991

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions smallvec versions prior to 0.6.3

Description An issue in the smallvec crate for Rust was discovered, where the Iterator implementation mishandles destructors, potentially leading to a double free. This occurs when an iterator passed to SmallVec::insert many panics in Iterator::next, causing destructors to run during unwinding while the vector is in an inconsistent state.

Recommendations For versions prior to 0.6.3, update to version 0.6.3 to resolve the issue. As a temporary workaround, consider avoiding the use of SmallVec::insert many with iterators that may panic in Iterator::next until the update is applied.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2018-20991

GHSA-RXR4-X558-X7HW

RUSTSEC-2018-0003

SUSE-SU-2021:1310-1

SUSE-SU-2021_1310-1

Affected Products

Suse

Smallvec

References · 19

• https://cve.org/CVERecord?id=CVE-2018-20991 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-20991 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-20991 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1310-1 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2018-0003 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20991 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxr4-x558-x7hw · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20991 · Vendor Advisory
• https://github.com/servo/rust-smallvec · Note
• https://github.com/servo/rust-smallvec/issues/96 · Note
• https://suse.com/security/cve/CVE-2018-20991 · Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://bugzilla.suse.com/1148293 · Note
• https://bugzilla.suse.com/1181571 · Note
• https://crates.io/crates/smallvec · Note