This advisory has been withdrawn and should be ignored. It is kept only for reference.
- Reported
-
- Issued
-
- Package
-
telemetry
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#memory-safety
- Aliases
-
- References
-
- CVSS Score
- 9.8
CRITICAL
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- High
- Integrity Impact
- High
- Availability Impact
- High
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Patched
-
no patched versions
Description
misc::vec_with_size creates a vector of the provided size and immediately
calls vec.set_len(size) on it, initially filling it with uninitialized memory.
It then inserts elements using vec[i] = value.clone().
If the value.clone() call panics, uninitialized items in the vector will be
dropped leading to undefined behavior.
Withdrawal
This advisory has been withdrawn because the above unsoundness cannot be triggered in safe code by dependents of the crate, as the Clone generic of private function misc::vec_with_size only instantiates to primitive types in public functions, which is impossible to panic.
Advisory available under CC0-1.0
license.