Drop of uninitialized memory in stack_dst

🗓️ 01 Sep 2021 18:30:55Reported by GitHub Advisory DatabaseType

Drop of uninitialized memory in stack_dst. Affected versions used push_inner function that increased internal array length then called val.clone(). If val.clone() call panics, stack could drop an already dropped element or drop uninitialized memory. Fixed in `2a4d538` by increasing array length after elements are cloned

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2021-28035	5 Mar 202109:15	–	attackerkb
Circl	CVE-2021-28035	5 Mar 202112:47	–	circl
CNNVD	Rust 安全漏洞	5 Mar 202100:00	–	cnnvd
CNVD	Unspecified Vulnerability in Rust (CNVD-2021-17259)	11 Mar 202100:00	–	cnvd
CVE	CVE-2021-28035	5 Mar 202108:39	–	cve
Cvelist	CVE-2021-28035	5 Mar 202108:39	–	cvelist
EUVD	EUVD-2021-1969	7 Oct 202500:30	–	euvd
NVD	CVE-2021-28035	5 Mar 202109:15	–	nvd
OSV	CVE-2021-28034	5 Mar 202109:15	–	osv
OSV	CVE-2021-28035	5 Mar 202109:15	–	osv

Vulners

Node

stack_dst_project stack_dstRange<0.6.1rust

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-28035
github	www.github.com/thepowersgang/stack_dst-rs/issues/5
github	www.github.com/thepowersgang/stack_dst-rs/commit/2a4d538
rustsec	www.rustsec.org/advisories/RUSTSEC-2021-0033.html
github	www.github.com/advisories/GHSA-45w7-7g63-2m5w

13 Jun 2023 20:53Current

8.8High risk

Vulners AI Score8.8

CVSS 27.5

CVSS 3.19.8

EPSS0.01167

CWE-908