Lucene search

K
osvGoogleOSV:RUSTSEC-2020-0021
HistoryMay 11, 2020 - 12:00 p.m.

rio allows a use-after-free buffer access when a future is leaked

2020-05-1112:00:00
Google
osv.dev
6

0.002 Low

EPSS

Percentile

59.0%

When a rio::Completion is leaked, its drop code will not run. The drop code
is responsible for waiting until the kernel completes the I/O operation into, or
out of, the buffer borrowed by rio::Completion. Leaking the struct will allow
one to access and/or drop the buffer, which can lead to a use-after-free,
data races or leaking secrets.

Upstream is not interested in fixing the issue.

0.002 Low

EPSS

Percentile

59.0%