diff --git a/crates/slice_deque/RUSTSEC-0000-0000.toml b/crates/slice_deque/RUSTSEC-0000-0000.toml new file mode 100644 index 0000000..7d36b3b --- /dev/null +++ b/crates/slice_deque/RUSTSEC-0000-0000.toml @@ -0,0 +1,25 @@ +[advisory] +id = "RUSTSEC-0000-0000" +package = "slice_deque" +date = "2018-12-05" +patched_versions = [">= 0.1.16"] +url = "https://github.com/gnzlbg/slice_deque/issues/57" +keywords = ["memory-corruption", "rce"] +title = "Bug in SliceDeque::move_head_unchecked allows read of corrupted memory" +description = """ + +Affected versions of this crate did not properly update the +head and tail of the deque when inserting and removing elements from the front +if, before insertion or removal, the tail of the deque was in the mirrored +memory region, and if, after insertion or removal, the head of the deque is +exactly at the beginning of the mirrored memory region. + +An attacker that controls both element insertion and removal into the deque +could put it in a corrupted state. Once the deque enters such an state, its head +and tail are corrupted, but in bounds of the allocated memory. This can result +in partial reads and writes, reads of uninitialized memory, reads of memory +containing previously dropped objects, etc. An attacker could exploit this to +alter program execution. + +The flaw was corrected by properly updating the head and tail of the deque in +this case. """