Reported

June 23, 2020

Issued

October 1, 2020 (last modified: June 13, 2023)

Package

linked-hash-map (crates.io)

Type

INFO Unsound

Aliases

• CVE-2020-25573
• GHSA-r43h-gmrm-h5c9

References

• https://github.com/contain-rs/linked-hash-map/pull/100

CVSS Score

9.8 CRITICAL

CVSS Details

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality Impact

High

Integrity Impact

High

Availability Impact

High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patched

• >=0.5.3

Description

Affected versions of this crate called mem::uninitialized() to create a NonNull<T>, which is undefined behavior.

The flaw was corrected by avoiding the use of mem::uninitialized().

Advisory available under CC0-1.0 license.