PT-2019-11551 · Rust+1 · Rust+1

Malojaffre · Published 2018-10-30 · Updated 2020-09-30 · CVE-2019-1010299

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: The Rust Programming Language Standard Library versions 1.18.0 through 1.29.0

Description: The issue concerns information exposure, where contents of uninitialized memory could be printed to a string or log file. This occurs in the Debug trait implementation for std::collections::vec deque::Iter. The attack vector involves invoking debug printing for an iterator over an empty VecDeque.

Recommendations: For versions 1.18.0 through 1.29.0, update to version 1.30.0 or a nightly version after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d to resolve the issue.

Exploit

Fix

Use of Uninitialized Resource

Information Disclosure

Weakness Enumeration

CWE-908

CWE-200

Related Identifiers

ALT-PU-2018-2578

CVE-2019-1010299

Affected Products

Alt Linux

Rust

References · 6

• 🔥 https://github.com/rust-lang/rust/issues/53566 · Exploit
• https://github.com/rust-lang/rust/pull/53571/commits/b85e4cc8fadaabd41da5b9645c08c68b8f89908d · Patch
• https://osv.dev/vulnerability/CVE-2019-1010299 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-1010299 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-1010299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010299 · Security Note