PT-2019-14538 · Renderdoc · Renderdoc

Published 2019-09-02 · Updated 2021-08-25 · CVE-2019-16142

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions renderdoc crate versions prior to 0.5.0

Description The issue arises from methods in the renderdoc crate that take self by immutable reference, which is incompatible with multi-threaded applications and can lead to unexpected behavior when called without synchronization. This technically unsound behavior can result in unpredictable outcomes.

Recommendations For versions prior to 0.5.0, update to release 0.5.0 to resolve the issue. As a temporary workaround, consider synchronizing access to methods that take self by immutable reference to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-16142

GHSA-VHFR-V4W9-45V8

RUSTSEC-2019-0018

Affected Products

Renderdoc

References · 8

• https://github.com/ebkalderon/renderdoc-rs/pull/32 · Patch
• https://osv.dev/vulnerability/RUSTSEC-2019-0018 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16142 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vhfr-v4w9-45v8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16142 · Security Note
• https://github.com/ebkalderon/renderdoc-rs · Note
• https://rustsec.org/advisories/RUSTSEC-2019-0018.html · Note
• https://crates.io/crates/renderdoc · Note