RUSTSEC-2022-0068 (CVE-2022-46149)

Vulnerability from osv_rustsec – Published: 2022-11-30 12:00 – Updated: 2022-11-30 22:16 – Source website
VLAI
Summary
out-of-bounds read possible when setting list-of-pointers
Details

If a message consumer expects data of type "list of pointers", and if the consumer performs certain specific actions on such data, then a message producer can cause the consumer to read out-of-bounds memory. This could trigger a process crash in the consumer, or in some cases could allow exfiltration of private in-memory data.

The C++ Cap'n Proto library is also affected by this bug. See the advisory on the main Cap'n Proto repo for a succinct description of the exact circumstances in which the problem can arise.

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-exposure"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "capnp",
        "purl": "pkg:cargo/capnp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.13.7"
            },
            {
              "introduced": "0.14.0-0"
            },
            {
              "fixed": "0.14.11"
            },
            {
              "introduced": "0.15.0-0"
            },
            {
              "fixed": "0.15.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2022-46149",
    "GHSA-qqff-4vw4-f6hx"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "If a message consumer expects data\nof type \"list of pointers\",\nand if the consumer performs certain specific actions on such data,\nthen a message producer can cause the consumer to read out-of-bounds memory.\nThis could trigger a process crash in the consumer,\nor in some cases could allow exfiltration of private in-memory data.\n\nThe C++ Cap\u0027n Proto library is also affected by this bug.\nSee the [advisory](https://github.com/capnproto/capnproto/tree/master/security-advisories/2022-11-30-0-pointer-list-bounds.md)\non the main Cap\u0027n Proto repo for a succinct description of\nthe exact circumstances in which the problem can arise.",
  "id": "RUSTSEC-2022-0068",
  "modified": "2022-11-30T22:16:39Z",
  "published": "2022-11-30T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/capnp"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2022-0068.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/capnproto/capnproto/tree/master/security-advisories/2022-11-30-0-pointer-list-bounds.md"
    },
    {
      "type": "WEB",
      "url": "https://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "out-of-bounds read possible when setting list-of-pointers"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.