kritisch
CVE-2020-36318
rust: use-after-free or double free in VecDeque::make_contiguous
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, CBL-Mariner. Niedriger laut Red Hat (mittel), Oracle (niedrig), Rocky Linux (niedrig).
Beschreibung
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| CBL-Mariner 1.0 | rust | 0:1.59.0-1.cm1 |
| debian 10 | rustc | kein Fix angegeben |
| debian 11 | rustc | kein Fix angegeben |
| debian 12 | rustc | 1.53.0+dfsg1-1 |
| debian 13 | rustc | 1.53.0+dfsg1-1 |
| debian 14 | rustc | 1.53.0+dfsg1-1 |
| debian 9 | rustc | kein Fix angegeben |
| echo | rustc | 1.53.0+dfsg1-1 |
| Oracle Linux 8 | cargo, cargo-doc, clippy und 11 weitere | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| rocky 8 | rust-toolset:rhel8::cargo, rust-toolset:rhel8::cargo-doc, rust-toolset:rhel8::clippy und 11 weitere | 1.49.0-1.module+el8.4.0+416+259a129a |
Alle 36 Einträge aus 10 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| CBL-Mariner 1.0 | rust | 0:1.59.0-1.cm1 |
| debian 10 | rustc | kein Fix angegeben |
| debian 11 | rustc | kein Fix angegeben |
| debian 12 | rustc | 1.53.0+dfsg1-1 |
| debian 13 | rustc | 1.53.0+dfsg1-1 |
| debian 14 | rustc | 1.53.0+dfsg1-1 |
| debian 9 | rustc | kein Fix angegeben |
| echo | rustc | 1.53.0+dfsg1-1 |
| Oracle Linux 8 | cargo | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | cargo-doc | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | clippy | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rls | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-analysis | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-debugger-common | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-doc | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-gdb | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-lldb | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-src | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-std-static | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-toolset | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rustfmt | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| rocky 8 | rust-toolset:rhel8::cargo | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::cargo-doc | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::clippy | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rls | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-analysis | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-debugger-common | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-doc | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-gdb | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-lldb | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-src | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-std-static | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-toolset | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rustfmt | 1.49.0-1.module+el8.4.0+416+259a129a |
Referenzen
- https://access.redhat.com/errata/RHSA-2021:1935
- https://access.redhat.com/security/cve/CVE-2020-36318
- https://bugzilla.redhat.com/show_bug.cgi?id=1949189
- https://bugzilla.redhat.com/show_bug.cgi?id=1949192
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36317
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36318
- https://errata.rockylinux.org/RLSA-2021:1935