CVE-2018-1000657

CWE-119 — Buffer Overflow7 documents7 sources

Severity

7.8HIGH

EPSS

0.2%

top 64.17%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Rust-lang Rust

Timeline

PublishedAug 20

Latest updateMay 14

Description

Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnerability in std::collections::vec_deque::VecDeque::reserve() function that can result in Arbitrary code execution, but no proof-of-concept exploit is currently published.. This vulnerability appears to have been fixed in after commit fdfafb510b1a38f727e920dccbeeb638d39a8e60; stable release 1.22.0 and later.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDrust-lang/rust1.3.0 — 1.22.0

▶Debianrustc< 1.22.1+dfsg1-1+3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

GHSA

GHSA-7877-m5c6-fgmx: Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1↗2022-05-14

▶

CVEList

CVE-2018-1000657: Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1↗2018-08-20

▶

OSV

CVE-2018-1000657: Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1↗2018-08-20

▶

📋Vendor Advisories

Red Hat

rust: Buffer Overflow vulnerability in std::collections::vec_deque::VecDeque::reserve() function↗2018-08-24

▶

Debian

CVE-2018-1000657: rustc - Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d...↗2018

▶

💬Community

Bugzilla

CVE-2018-1000657 rust: Buffer Overflow vulnerability in std::collections::vec_deque::VecDeque::reserve() function↗2018-08-24

▶