GitHub Advisoryadvisory · crates.io

GHSA-45w7-7g63-2m5w Drop of uninitialized memory in stack_dst

CRITICAL Published 2021-09-01 Modified 2023-06-13 Official page ↗
Aliases
CVE-2021-28035
Ecosystem
crates.io
Packages
stack_dst
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-908
Reviewed
2021-08-30

Affected packages

• crates.io stack_dst: < 0.6.1 → fixed in 0.6.1

Description

Affected versions of stack_dst used a push_inner function that increased the internal length of the array and then called val.clone(). If the val.clone() call panics, the stack could drop an already dropped element or drop uninitialized memory. This issue was fixed in `2a4d538` by increasing the length of the array after elements are cloned.

Related

Alias · CVE (1)

  • CVE-2021-28035 An issue was discovered in the stack_dst crate before 0.6.1 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-908 Use of Uninitialized Resource weakness

References