GitHub Advisoryadvisory · crates.io

GHSA-mm7v-vpv8-xfc3 Double free in smallvec

CRITICAL Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2019-15551
Ecosystem
crates.io
Packages
smallvec
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-415
Reviewed
2021-08-19

Affected packages

• crates.io smallvec: >= 0.6.5, < 0.6.10 → fixed in 0.6.10

Description

Attempting to call grow on a spilled SmallVec with a value equal to the current capacity causes it to free the existing data. This performs a double free immediately and may lead to use-after-free on subsequent accesses to the SmallVec contents. An attacker that controls the value passed to grow may exploit this flaw to obtain memory contents or gain remote code execution.

Related

Alias · CVE (1)

  • CVE-2019-15551 An issue was discovered in the smallvec crate before 0.6.10 for Rust. vulnerability

Weakness · CWE (1)

References