PT-2019-14267 · Rust · Smallvec

Published 2019-06-06 · Updated 2021-08-25 · CVE-2019-15551

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions smallvec crate versions prior to 0.6.10

Description An issue in the smallvec crate allows for a double free when attempting to call grow on a spilled SmallVec with a value equal to the current capacity, potentially leading to use-after-free on subsequent accesses to the SmallVec contents. An attacker controlling the value passed to grow may exploit this to obtain memory contents or gain remote code execution.

Recommendations For versions prior to 0.6.10, update to version 0.6.10 or later to resolve the issue. As a temporary workaround, consider restricting the use of the grow function on spilled SmallVec instances to minimize the risk of exploitation.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2019-15551

GHSA-MM7V-VPV8-XFC3

RUSTSEC-2019-0009

Affected Products

Smallvec

References · 13

• https://github.com/servo/rust-smallvec/issues/148 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-15551 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2019-0009 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-15551 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15551 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-15551 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mm7v-vpv8-xfc3 · Vendor Advisory
• https://github.com/servo/rust-smallvec/issues/149 · Note
• https://github.com/servo/rust-smallvec · Note
• https://github.com/servo/rust-smallvec/commit/c20cfa8584e649f00dc0767ab6fad63a3f59a296 · Note
• https://github.com/servo/rust-smallvec/commit/f96322b9243405cc82701cc73f1b19313b413ab4 · Note
• https://crates.io/crates/smallvec · Note
• https://rustsec.org/advisories/RUSTSEC-2019-0009.html · Note