From 895fe023dff80e74abf9cea594e491e579cd749c Mon Sep 17 00:00:00 2001 From: gnzlbg Date: Thu, 6 Dec 2018 16:01:58 +0100 Subject: [PATCH 1/2] Add advisory for slice-deque --- crates/slice_deque/RUSTSEC-0000-0000.toml | 24 +++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 crates/slice_deque/RUSTSEC-0000-0000.toml diff --git a/crates/slice_deque/RUSTSEC-0000-0000.toml b/crates/slice_deque/RUSTSEC-0000-0000.toml new file mode 100644 index 0000000..8d3a1ad --- /dev/null +++ b/crates/slice_deque/RUSTSEC-0000-0000.toml @@ -0,0 +1,24 @@ +[advisory] +id = "RUSTSEC-0000-0000" +package = "slice_deque" +date = "2018-12-05" +patched_versions = [">= 0.1.16"] +url = "https://github.com/gnzlbg/slice_deque/issues/57" +title = "Bug in SliceDeque::move_head_unchecked allows read of corrupted memory" +description = """ + +Affected versions of this crate did not properly update the +head and tail of the deque when inserting and removing elements from the front +if, before insertion or removal, the tail of the deque was in the mirrored +memory region, and if, after insertion or removal, the head of the deque is +exactly at the beginning of the mirrored memory region. + +An attacker that controls both element insertion and removal into the deque +could put it in a corrupted state. Once the deque enters such an state, its head +and tail are corrupted, but in bounds of the allocated memory. This can result +in partial reads and writes, reads of uninitialized memory, reads of memory +containing previously dropped objects, etc. An attacker could exploit this to +alter program execution. + +The flaw was corrected by properly updating the head and tail of the deque in +this case. """ From 4effd1975e50cb0b5314052ab00b01e85652546b Mon Sep 17 00:00:00 2001 From: gnzlbg Date: Thu, 6 Dec 2018 17:58:48 +0100 Subject: [PATCH 2/2] Add keywords --- crates/slice_deque/RUSTSEC-0000-0000.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/crates/slice_deque/RUSTSEC-0000-0000.toml b/crates/slice_deque/RUSTSEC-0000-0000.toml index 8d3a1ad..7d36b3b 100644 --- a/crates/slice_deque/RUSTSEC-0000-0000.toml +++ b/crates/slice_deque/RUSTSEC-0000-0000.toml @@ -4,6 +4,7 @@ package = "slice_deque" date = "2018-12-05" patched_versions = [">= 0.1.16"] url = "https://github.com/gnzlbg/slice_deque/issues/57" +keywords = ["memory-corruption", "rce"] title = "Bug in SliceDeque::move_head_unchecked allows read of corrupted memory" description = """