Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdqMzYtZ2M0ci05eDNy

Out of bounds access in compact_arena

Affected versions of this crate did not properly implement the generativity, because the invariant lifetimes were not necessarily dropped.

This allows an attacker to mix up two arenas, using indices created from one arena with another one. This might lead to an out-of-bounds read or write access into the memory reserved for the arena.

The flaw was corrected by implementing generativity correctly in version 0.4.0.

Permalink: https://github.com/advisories/GHSA-7j36-gc4r-9x3r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdqMzYtZ2M0ci05eDNy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 3 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-7j36-gc4r-9x3r, CVE-2019-16139
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-16139
• https://github.com/llogiq/compact_arena/issues/22
• https://rustsec.org/advisories/RUSTSEC-2019-0015.html
• https://github.com/advisories/GHSA-7j36-gc4r-9x3r

Repository: https://github.com/llogiq/compact_arena
Blast Radius: 9.4

Affected Packages