CVE-2020-36318 - In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the sam

CVE-2020-36318

Summary

In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.

References

https://github.com/rust-lang/rust/issues/79808
https://github.com/rust-lang/rust/issues/79808
https://github.com/rust-lang/rust/pull/79814
https://github.com/rust-lang/rust/pull/79814

Vulnerable Configurations

cpe:2.3:a:rust-lang:rust:1.48.0:*:*:*:*:*:*:*
cpe:2.3:a:rust-lang:rust:1.48.0:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 21-11-2024 - 05:29)
Impact:
Exploitability:

CWE

CWE-416

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

Last major update

21-11-2024 - 05:29

Published

11-04-2021 - 20:15

Last modified

21-11-2024 - 05:29