PT-2019-14269 · Rust · Memoffset

Published 2019-07-16 · Updated 2021-08-25 · CVE-2019-15553

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions memoffset crate versions prior to 0.5.0

Description An issue in the memoffset crate can cause exposure of uninitialized memory. The affected versions of this crate can lead to traps and/or memory unsafety by zero-initializing references. Additionally, they can cause uninitialized memory to be dropped if the field for which the offset is requested was behind a deref coercion, and that deref coercion caused a panic. The flaw was corrected by using MaybeUninit.

Recommendations For versions prior to 0.5.0, update to version 0.5.0 or later to resolve the issue. As a temporary workaround, consider using MaybeUninit to prevent uninitialized memory exposure until the update is applied.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2019-15553

GHSA-RH89-X75F-RH3C

RUSTSEC-2019-0011

Affected Products

Memoffset

References · 13

• https://security-tracker.debian.org/tracker/CVE-2019-15553 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-15553 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15553 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-15553 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15553 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15553 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2019-0011 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rh89-x75f-rh3c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15553 · Security Note
• https://github.com/Gilnaa/memoffset/issues/9#issuecomment-505461490 · Note
• https://github.com/Gilnaa/memoffset · Note
• https://rustsec.org/advisories/RUSTSEC-2019-0011.html · Note
• https://crates.io/crates/memoffset · Note