From 144eb01eef694be23db61f747be9fb431c28e81d Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Sun, 30 Jun 2019 20:04:20 +0200 Subject: [PATCH 1/3] Add advisory for SmallVec issues #148 --- crates/smallvec/RUSTSEC-2019-0000.toml | 58 ++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 crates/smallvec/RUSTSEC-2019-0000.toml diff --git a/crates/smallvec/RUSTSEC-2019-0000.toml b/crates/smallvec/RUSTSEC-2019-0000.toml new file mode 100644 index 0000000..e019bb9 --- /dev/null +++ b/crates/smallvec/RUSTSEC-2019-0000.toml @@ -0,0 +1,58 @@ +[advisory] +id = "RUSTSEC-0000-0000" + +# Name of the affected crate (mandatory) +package = "smallvec" + +# Disclosure date of the advisory as an RFC 3339 date (mandatory) +date = "2019-06-06" + +# Single-line description of a vulnerability (mandatory) +title = "Double-free and use-after-free in SmallVec::grow()" + +# Enter a short-form description of the vulnerability here (mandatory) +description = """ +Attempting to call `grow` on a spilled SmallVec with a value equal to the current capacity causes it to free the existing data. This performs a double free immediately and may lead to use-after-free on subsequent accesses to the SmallVec contents. + +An attacker that controls the value passed to `grow` may exploit this flaw to obtain memory contents or gain remote code execution. + +Credits to @ehuss for discovering, reporting and fixing the bug. +""" + +# Versions which include fixes for this vulnerability (mandatory) +patched_versions = [">= 0.6.10"] + +# Versions which were never vulnerable (optional) +unaffected_versions = ["< 0.6.5"] + +# URL to a long-form description of this issue, e.g. a GitHub issue/PR, +# a change log entry, or a blogpost announcing the release (optional) +url = "https://github.com/servo/rust-smallvec/issues/148" + +# Keywords which describe this vulnerability, similar to Cargo (optional) +keywords = ["double free", "use after free", "arbitrary code execution"] + +# Vulnerability aliases, e.g. CVE IDs (optional but recommended) +# Request a CVE for your RustSec vulns: https://iwantacve.org/ +#aliases = ["CVE-2018-XXXX"] + +# References to related vulnerabilities (optional) +# e.g. CVE for a C library wrapped by a -sys crate) +#references = ["CVE-2018-YYYY", "CVE-2018-ZZZZ"] + +# CPU architectures impacted by this vulnerability (optional) +# For a list of CPU architecture strings, see the "platforms" crate: +# +#affected_arch = ["x86", "x86_64"] + +# Operating systems impacted by this vulnerability (optional) +# For a list of OS strings, see the "platforms" crate: +# +#affected_os = ["windows"] + +# List of canonical paths to vulnerable functions (optional) +# The path syntax is cratename::path::to::function, without any +# return type or parameters. More information: +# +# For example, for RUSTSEC-2018-0003, this would look like: +affected_functions = ["smallvec::SmallVec::grow"] From 7af1eac5b172f62998ef3841fd56c57185176a70 Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Sun, 30 Jun 2019 20:11:34 +0200 Subject: [PATCH 2/3] Rename tentative advisory to please CI --- .../smallvec/{RUSTSEC-2019-0000.toml => RUSTSEC-0000-0000.toml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename crates/smallvec/{RUSTSEC-2019-0000.toml => RUSTSEC-0000-0000.toml} (100%) diff --git a/crates/smallvec/RUSTSEC-2019-0000.toml b/crates/smallvec/RUSTSEC-0000-0000.toml similarity index 100% rename from crates/smallvec/RUSTSEC-2019-0000.toml rename to crates/smallvec/RUSTSEC-0000-0000.toml From 2cbddfd81d43bab3601f4b46f715ea314d80674e Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Tue, 2 Jul 2019 22:55:15 +0200 Subject: [PATCH 3/3] Drop comments from new smallvec advisory --- crates/smallvec/RUSTSEC-0000-0000.toml | 41 -------------------------- 1 file changed, 41 deletions(-) diff --git a/crates/smallvec/RUSTSEC-0000-0000.toml b/crates/smallvec/RUSTSEC-0000-0000.toml index e019bb9..8c78e46 100644 --- a/crates/smallvec/RUSTSEC-0000-0000.toml +++ b/crates/smallvec/RUSTSEC-0000-0000.toml @@ -1,16 +1,8 @@ [advisory] id = "RUSTSEC-0000-0000" - -# Name of the affected crate (mandatory) package = "smallvec" - -# Disclosure date of the advisory as an RFC 3339 date (mandatory) date = "2019-06-06" - -# Single-line description of a vulnerability (mandatory) title = "Double-free and use-after-free in SmallVec::grow()" - -# Enter a short-form description of the vulnerability here (mandatory) description = """ Attempting to call `grow` on a spilled SmallVec with a value equal to the current capacity causes it to free the existing data. This performs a double free immediately and may lead to use-after-free on subsequent accesses to the SmallVec contents. @@ -18,41 +10,8 @@ An attacker that controls the value passed to `grow` may exploit this flaw to ob Credits to @ehuss for discovering, reporting and fixing the bug. """ - -# Versions which include fixes for this vulnerability (mandatory) patched_versions = [">= 0.6.10"] - -# Versions which were never vulnerable (optional) unaffected_versions = ["< 0.6.5"] - -# URL to a long-form description of this issue, e.g. a GitHub issue/PR, -# a change log entry, or a blogpost announcing the release (optional) url = "https://github.com/servo/rust-smallvec/issues/148" - -# Keywords which describe this vulnerability, similar to Cargo (optional) keywords = ["double free", "use after free", "arbitrary code execution"] - -# Vulnerability aliases, e.g. CVE IDs (optional but recommended) -# Request a CVE for your RustSec vulns: https://iwantacve.org/ -#aliases = ["CVE-2018-XXXX"] - -# References to related vulnerabilities (optional) -# e.g. CVE for a C library wrapped by a -sys crate) -#references = ["CVE-2018-YYYY", "CVE-2018-ZZZZ"] - -# CPU architectures impacted by this vulnerability (optional) -# For a list of CPU architecture strings, see the "platforms" crate: -# -#affected_arch = ["x86", "x86_64"] - -# Operating systems impacted by this vulnerability (optional) -# For a list of OS strings, see the "platforms" crate: -# -#affected_os = ["windows"] - -# List of canonical paths to vulnerable functions (optional) -# The path syntax is cratename::path::to::function, without any -# return type or parameters. More information: -# -# For example, for RUSTSEC-2018-0003, this would look like: affected_functions = ["smallvec::SmallVec::grow"]