OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-05 03:00:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #293 from NieDzejkob/rio

Browse Source 
Advisory for rio
This commit is contained in:
Sergey "Shnatsel" Davidoff
2020-07-03 16:09:14 +02:00
committed by GitHub
parent 297725a166 b1d3a5e73f
commit c05fb28d6d
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
crates/rio/RUSTSEC-0000-0000.toml Normal file
View File

@@ -0,0 +1,19 @@
[advisory]
id = "RUSTSEC-0000-0000"
package = "rio"
date = "2020-05-11"
title = "rio allows a use-after-free buffer access when a future is leaked"
url = "https://github.com/spacejam/rio/issues/11"
categories = ["memory-corruption", "memory-exposure"]
description = """
When a `rio::Completion` is leaked, its drop code will not run. The drop code
is responsible for waiting until the kernel completes the I/O operation into, or
out of, the buffer borrowed by `rio::Completion`. Leaking the struct will allow
one to access and/or drop the buffer, which can lead to a use-after-free,
data races or leaking secrets.
Upstream is not interested in fixing the issue.
"""
[versions]
patched = []