OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-02-16 06:06:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #229 from jfoote/master

Browse Source 
Add lucet-runtime-internals sigstack allocation vuln advisory
This commit is contained in:
Tony Arcieri
2020-01-27 07:18:20 -08:00
committed by GitHub
parent 81d10a945b 0271003e2e
commit 723abd4d2b
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
crates/lucet-runtime-internals/RUSTSEC-0000-0000.toml Normal file
View File

@@ -0,0 +1,24 @@
[advisory]
id = "RUSTSEC-0000-0000"
package = "lucet-runtime-internals"
date = "2020-01-24"
title = "sigstack allocation bug can cause memory corruption or leak"
description = """
An embedding using affected versions of lucet-runtime configured to use
non-default Wasm globals sizes of more than 4KiB, or compiled in debug mode
without optimizations, could leak data from the signal handler stack to guest
programs. This can potentially cause data from the embedding host to leak to
guest programs or cause corruption of guest program memory.
This flaw was resolved by correcting the sigstack allocation logic.
"""
patched_versions = ["< 0.5.0, >= 0.4.3", ">= 0.5.1"]
url = "https://github.com/bytecodealliance/lucet/pull/401"
categories = ["memory-corruption", "memory-exposure"]