PT-2018-15606 · Rust · Actix-Web
Published
2018-06-08
·
Updated
2022-01-06
·
CVE-2018-25025
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
actix-web crate versions prior to 0.7.15
Description
The issue concerns multiple memory safety problems, including unsoundly coercing immutable references to mutable references, unsoundly extending lifetimes of strings, and adding the
Send marker trait to objects that cannot be safely sent between threads. This may result in various memory corruption scenarios, most likely use-after-free. A significant refactoring effort has been conducted to resolve these issues.Recommendations
For versions prior to 0.7.15, update to version 0.7.15 or later to resolve the memory safety issues. As a temporary workaround, consider restricting the use of functions that may lead to memory corruption until a patch is applied. Avoid using the affected crate in multithreaded environments where the
Send marker trait is utilized until the issue is resolved.Fix
Race Condition
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Actix-Web