- Reported
-
- Issued
-
- Package
-
alg_ds
(crates.io)
- Type
-
Vulnerability
- Aliases
-
- References
-
- CVSS Score
- 9.8
CRITICAL
- CVSS Details
-
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Patched
-
no patched versions
Description
Matrix::new() internally calls Matrix::fill_with() which uses *ptr = value pattern to initialize the buffer.
This pattern assumes that there is an initialized struct at the address and drops it, which results in dropping of uninitialized struct.
Advisory available under CC0-1.0
license.