Use-After-Free and Double Free Vulnerability in Rust Standard Library
CVE-2020-36318

9.8CRITICAL

Key Information:

Vendor
Rust-lang
Status
Rust
Vendor
CVE Published:
11 April 2021

Summary

The standard library in Rust prior to version 1.49.0 contains a flaw in the VecDeque::make_contiguous function that can lead to a use-after-free or double free condition. This issue arises when the function incorrectly pops the same element multiple times under specific circumstances, potentially causing memory corruption and unpredictable behavior in applications relying on this implementation.

References

https://github.com/rust-lang/rust/issues/79808
x_refsource_MISC
https://github.com/rust-lang/rust/pull/79814
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.