PT-2021-8382 · Rust+1 · Rust+1

Bluss · Published 2021-04-11 · Updated 2021-04-22 · CVE-2015-20001

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rust versions prior to 1.2.0

Description The issue arises from the standard library in Rust, where the BinaryHeap is not panic-safe. When the comparison of generic elements inside sift up or sift down range panics, the binary heap is left in an inconsistent state. This can lead to a drop of zeroed memory as an arbitrary type, resulting in a memory safety violation.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-20001

Affected Products

Astra Linux

Rust

References · 9

• 🔥 https://github.com/rust-lang/rust/issues/25842 · Exploit
• https://github.com/rust-lang/rust/pull/25856 · Patch
• https://osv.dev/vulnerability/CVE-2015-20001 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-20001 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-20001 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-20001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-20001 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-20001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-20001 · Security Note