HistoryEditJSON (OSV)

RUSTSEC-2021-0046

misc::vec_with_size() can drop uninitialized memory if clone panics

Reported
Issued
Package
telemetry (crates.io)
Type
Vulnerability
Categories
Keywords
#memory-safety
Aliases
References
CVSS Score
9.8 CRITICAL
CVSS Details
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Patched
no patched versions

Description

misc::vec_with_size creates a vector of the provided size and immediately calls vec.set_len(size) on it, initially filling it with uninitialized memory. It then inserts elements using vec[i] = value.clone().

If the value.clone() call panics, uninitialized items in the vector will be dropped leading to undefined behavior.

Advisory available under CC0-1.0 license.