HistoryEditJSON (OSV)

RUSTSEC-2020-0021

rio allows a use-after-free buffer access when a future is leaked

Reported
Issued
Package
rio (crates.io)
Type
Vulnerability
Categories
Aliases
References
CVSS Score
9.8 CRITICAL
CVSS Details
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Patched
no patched versions

Description

When a rio::Completion is leaked, its drop code will not run. The drop code is responsible for waiting until the kernel completes the I/O operation into, or out of, the buffer borrowed by rio::Completion. Leaking the struct will allow one to access and/or drop the buffer, which can lead to a use-after-free, data races or leaking secrets.

Upstream is not interested in fixing the issue.

Advisory available under CC0-1.0 license.