GitHub Advisoryadvisory · crates.io
GHSA-69gw-hgj3-45m7 Memory corruption in smallvec
CRITICAL
Official page ↗
- Aliases
- CVE-2019-15554
- Ecosystem
- crates.io
- Packages
- smallvec
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-787
- Reviewed
- 2021-08-19
Affected packages
• crates.io smallvec: >= 0.6.3, < 0.6.10 → fixed in 0.6.10
Description
Attempting to call grow on a spilled SmallVec with a value less than the current capacity causes corruption of memory allocator data structures. An attacker that controls the value passed to grow may exploit this flaw to obtain memory contents or gain remote code execution.
Related
Alias · CVE (1)
- CVE-2019-15554 An issue was discovered in the smallvec crate before 0.6.10 for Rust. vulnerability
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness