OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-09 13:09:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add lucet-runtime-internals sigstack allocation vuln advisory

Browse Source
This commit is contained in:
Jonathan Foote
2020-01-24 15:27:56 -05:00
parent b88eb18c3b
commit f8ff9cfc6f
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
crates/lucet-runtime-internals/RUSTSEC-0000-0000.toml Normal file
View File

@@ -0,0 +1,24 @@
[advisory]
id = "RUSTSEC-0000-0000"
package = "lucet-runtime-internals"
date = "2020-01-24"
title = "sigstack allocation bug can cause memory corruption or leak"
description = """
An embedding using affected versions of lucet-runtime configured to use
non-default Wasm globals sizes of more than 4KiB, or compiled in debug mode
without optimizations, could leak data from the signal handler stack to guest
programs. This can potentially cause data from the embedding host to leak to
guest programs or cause corruption of guest program memory.
This flaw was resolved by correcting the sigstack allocation logic.
"""
patched_versions = ["< 0.5.0, >= 0.4.3", “>= 0.5.1”]
url = "https://github.com/bytecodealliance/lucet/pull/401”
categories = ["memory-corruption", "memory-exposure"]