Lucene search

K
rustsecRustsecRUSTSEC-2020-0021
HistoryMay 11, 2020 - 12:00 p.m.

rio allows a use-after-free buffer access when a future is leaked

2020-05-1112:00:00
rustsec.org
10

0.002 Low

EPSS

Percentile

59.0%

When a rio::Completion is leaked, its drop code will not run. The drop code
is responsible for waiting until the kernel completes the I/O operation into, or
out of, the buffer borrowed by rio::Completion. Leaking the struct will allow
one to access and/or drop the buffer, which can lead to a use-after-free,
data races or leaking secrets.

Upstream is not interested in fixing the issue.

CPENameOperatorVersion
rioeqany

0.002 Low

EPSS

Percentile

59.0%

Related for RUSTSEC-2020-0021