OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-06 03:29:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #461 from RustSec/assign-ids

Browse Source 
Assigned RUSTSEC-2020-0060 to futures-task
This commit is contained in:
Sergey "Shnatsel" Davidoff
2020-10-31 14:12:54 +01:00
committed by GitHub
parent ababdd40a6 338f097760
commit b3b6f8501a
1 changed files with 23 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
crates/futures-task/RUSTSEC-0000-0000.md → crates/futures-task/RUSTSEC-2020-0060.md
View File

@@ -1,23 +1,23 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "futures-task"
date = "2020-09-04"
url = "https://github.com/rust-lang/futures-rs/pull/2206"
categories = ["code-execution", "memory-corruption"]
keywords = ["use-after-free", "arbitrary code execution", "memory-corruption", "memory-management"]
[versions]
patched = [">= 0.3.6"]
unaffected = ["<= 0.2.1"]
[affected]
functions = { "futures_task::waker" = [">= 0.3.0"] }
```
# futures_task::waker may cause a use-after-free if used on a type that isn't 'static
Affected versions of the crate did not properly implement a `'static` lifetime bound on the `waker` function.
This resulted in a use-after-free if `Waker::wake()` is called after original data had been dropped.
The flaw was corrected by adding `'static` lifetime bound to the data `waker` takes.
```toml
[advisory]
id = "RUSTSEC-2020-0060"
package = "futures-task"
date = "2020-09-04"
url = "https://github.com/rust-lang/futures-rs/pull/2206"
categories = ["code-execution", "memory-corruption"]
keywords = ["use-after-free", "arbitrary code execution", "memory-corruption", "memory-management"]
[versions]
patched = [">= 0.3.6"]
unaffected = ["<= 0.2.1"]
[affected]
functions = { "futures_task::waker" = [">= 0.3.0"] }
```
# futures_task::waker may cause a use-after-free if used on a type that isn't 'static
Affected versions of the crate did not properly implement a `'static` lifetime bound on the `waker` function.
This resulted in a use-after-free if `Waker::wake()` is called after original data had been dropped.
The flaw was corrected by adding `'static` lifetime bound to the data `waker` takes.