Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02OHA0LXBqcGYteHdjcc4AAnhW

insert_slice_clone can double drop if Clone panics.

Affected versions of this crate used ptr::copy when inserting into the middle of a Vec. When ownership was temporarily duplicated during this copy, it calls the clone method of a user provided element.

This issue can result in an element being double-freed if the clone call panics.

Commit 20cb73d fixed this issue by adding a set_len(0) call before operating on the vector to avoid dropping the elements during a panic.

Permalink: https://github.com/advisories/GHSA-68p4-pjpf-xwcq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02OHA0LXBqcGYteHdjcc4AAnhW
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Identifiers: GHSA-68p4-pjpf-xwcq, CVE-2021-26954
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-26954
• https://rustsec.org/advisories/RUSTSEC-2021-0018.html
• https://github.com/qwertz19281/rust_utils/issues/3
• https://github.com/qwertz19281/rust_utils/commit/20cb73d
• https://github.com/advisories/GHSA-68p4-pjpf-xwcq

Repository: https://github.com/qwertz19281/rust_utils
Blast Radius: 1.0

Affected Packages