RUSTSEC-2019-0009

Double-free and use-after-free in SmallVec::grow()

Reported

June 6, 2019

Issued

October 1, 2020 (last modified: June 13, 2023)

Package

smallvec (crates.io)

Type

Vulnerability

Keywords

#double-free #use-after-free #arbitrary-code-execution

Aliases

References

https://github.com/servo/rust-smallvec/issues/148

CVSS Score

9.8 CRITICAL

CVSS Details

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patched

>=0.6.10

Unaffected

<0.6.5

Affected Functions

Version

smallvec::SmallVec::grow

<0.6.10, >=0.6.5

Description

Attempting to call grow on a spilled SmallVec with a value equal to the current capacity causes it to free the existing data. This performs a double free immediately and may lead to use-after-free on subsequent accesses to the SmallVec contents.

An attacker that controls the value passed to grow may exploit this flaw to obtain memory contents or gain remote code execution.

Credits to @ehuss for discovering, reporting and fixing the bug.

Advisory available under CC0-1.0 license.