GitHub Advisoryadvisory · crates.io

GHSA-7j36-gc4r-9x3r Out of bounds access in compact_arena

CRITICAL Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2019-16139
Ecosystem
crates.io
Packages
compact_arena
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-125, CWE-787
Reviewed
2021-08-19

Affected packages

• crates.io compact_arena: < 0.4.0 → fixed in 0.4.0

Description

Affected versions of this crate did not properly implement the generativity, because the invariant lifetimes were not necessarily dropped. This allows an attacker to mix up two arenas, using indices created from one arena with another one. This might lead to an out-of-bounds read or write access into the memory reserved for the arena. The flaw was corrected by implementing generativity correctly in version 0.4.0.

Related

Alias · CVE (1)

  • CVE-2019-16139 An issue was discovered in the compact_arena crate before 0.4.0 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-787 Out-of-bounds Write weakness

References