Lucene search

K
rustsecRustsecRUSTSEC-2021-0029
HistoryFeb 17, 2021 - 12:00 p.m.

Tape::take_bytes exposes uninitialized memory to a user-provided Read

2021-02-1712:00:00
rustsec.org
11
tape::take_bytes
uninitialized memory
user-provided read
undefined behavior
safe read
software vulnerability

EPSS

0.002

Percentile

53.8%

Affected versions of this crate passed an unininitialized buffer to a
user-provided Read instance in Tape::take_bytes.

This can result in safe Read implementations reading from the uninitialized
buffer leading to undefined behavior.

The flaw was corrected in commit 1f2dc7f37dd by removing the unsafe block
and zero-initializing the buffer.

EPSS

0.002

Percentile

53.8%

Related for RUSTSEC-2021-0029