PT-2021-18544 · Arenavec · Arenavec
Published
2021-01-12
·
Updated
2021-08-25
·
CVE-2021-29931
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
arenavec crate through 2021-01-12
arenavec crate through 0.1.1
Description
An issue was discovered in the arenavec crate where affected versions did not guard against potential panics that may happen from user-provided functions
T::default() and T::drop(). A panic within T::default() leads to dropping uninitialized T when invoked from common::Slice::<T, H>::new(). A panic within T::drop() leads to a double drop of T when invoked from common::SliceVec::<T, H>::resize with() or common::SliceVec::<T, H>::resize(). Either case causes memory corruption in the heap memory.Recommendations
For versions through 2021-01-12, consider disabling the
T::drop() function to prevent double drop issues until a patch is available.
For versions through 0.1.1, restrict the use of T::default() to prevent dropping uninitialized memory until a fix is applied.
As a temporary workaround, avoid using the common::Slice::<T, H>::new(), common::SliceVec::<T, H>::resize with(), and common::SliceVec::<T, H>::resize() functions with user-provided T::default() and T::drop() functions until the issue is resolved.Fix
Memory Corruption
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Arenavec