PT-2018-9509 · Rust+1 · Rust Standard Library+1

Jesse99 · Published 2018-03-25 · Updated 2018-10-18 · CVE-2018-1000657

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rust standard library versions Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e through Commit fdfafb510b1a38f727e920dccbeeb638d39a8e60 Rust standard library version 1.3.0 through 1.22.0

Description The issue is related to a Buffer Overflow vulnerability in the std::collections::vec deque::VecDeque::reserve() function, which can result in Arbitrary code execution. No proof-of-concept exploit is currently published.

Recommendations For versions Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e through Commit fdfafb510b1a38f727e920dccbeeb638d39a8e60, update to a version after Commit fdfafb510b1a38f727e920dccbeeb638d39a8e60. For version 1.3.0 through 1.22.0, update to version 1.22.0 or later. As a temporary workaround, consider disabling the std::collections::vec deque::VecDeque::reserve() function until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-1482

CVE-2018-1000657

Affected Products

Alt Linux

Rust Standard Library

References · 13

• https://github.com/rust-lang/rust/commit/f71b37bc28326e272a37b938e835d4f99113eec2 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000657 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1000657 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000657 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000657 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000657 · Security Note
• https://ubuntu.com/security/CVE-2018-1000657 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000657 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-1482 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1000657 · Vendor Advisory
• https://github.com/rust-lang/rust/issues/44800 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2018-1000657 · Note
• http://securityfocus.com/bid/105188 · Note