PT-2018-9534 · Rust+1 · Rust Programming Language Standard Library+1

Published 2018-09-29 · Updated 2019-01-04 · CVE-2018-1000810

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Rust Programming Language Standard Library versions 1.27.1 through 1.29.0 The Rust Programming Language Standard Library version 1.27.2 The Rust Programming Language Standard Library version 1.28.0 The Rust Programming Language Standard Library versions 126.0 through 126.2 The Rust Programming Language Standard Library version 127.0

Description The issue is related to an integer overflow to buffer overflow in the standard library, which can result in a buffer overflow. This can be exploited via the str::repeat function, passed a large number, causing an internal buffer overflow.

Recommendations For version 1.27.1, update to version 1.29.1 or later. For version 1.27.2, update to version 1.29.1 or later. For version 1.28.0, update to version 1.29.1 or later. For versions 126.0 through 126.2, update to version 1.29.1 or later. For version 127.0, update to version 1.29.1 or later. As a temporary workaround, consider avoiding the use of the str::repeat function with large numbers until a patch is available.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2018-2401

CVE-2018-1000810

MGASA-2018-0407

Affected Products

Alt Linux

Rust Programming Language Standard Library

References · 13

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000810 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-2401 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0407 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000810 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000810 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0407.html · Security Note
• https://blog.rust-lang.org/2018/09/21/Security-advisory-for-std.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000810 · Vendor Advisory
• https://security.gentoo.org/glsa/201812-11 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1000810 · Vendor Advisory
• https://groups.google.com/forum/#%21topic/rustlang-security-announcements/CmSuTm-SaU0 · Note
• https://bugs.mageia.org/show_bug.cgi?id=23701 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2018-1000810 · Note