crítica
CVE-2020-36318
rust: use-after-free or double free in VecDeque::make_contiguous
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, CBL-Mariner. Más baja según Red Hat (media), Oracle (baja), Rocky Linux (baja).
Descripción
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| CBL-Mariner 1.0 | rust | 0:1.59.0-1.cm1 |
| debian 10 | rustc | sin corrección indicada |
| debian 11 | rustc | sin corrección indicada |
| debian 12 | rustc | 1.53.0+dfsg1-1 |
| debian 13 | rustc | 1.53.0+dfsg1-1 |
| debian 14 | rustc | 1.53.0+dfsg1-1 |
| debian 9 | rustc | sin corrección indicada |
| echo | rustc | 1.53.0+dfsg1-1 |
| Oracle Linux 8 | cargo, cargo-doc, clippy y 11 más | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| rocky 8 | rust-toolset:rhel8::cargo, rust-toolset:rhel8::cargo-doc, rust-toolset:rhel8::clippy y 11 más | 1.49.0-1.module+el8.4.0+416+259a129a |
Mostrar las 36 entradas de 10 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| CBL-Mariner 1.0 | rust | 0:1.59.0-1.cm1 |
| debian 10 | rustc | sin corrección indicada |
| debian 11 | rustc | sin corrección indicada |
| debian 12 | rustc | 1.53.0+dfsg1-1 |
| debian 13 | rustc | 1.53.0+dfsg1-1 |
| debian 14 | rustc | 1.53.0+dfsg1-1 |
| debian 9 | rustc | sin corrección indicada |
| echo | rustc | 1.53.0+dfsg1-1 |
| Oracle Linux 8 | cargo | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | cargo-doc | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | clippy | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rls | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-analysis | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-debugger-common | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-doc | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-gdb | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-lldb | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-src | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-std-static | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-toolset | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rustfmt | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| rocky 8 | rust-toolset:rhel8::cargo | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::cargo-doc | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::clippy | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rls | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-analysis | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-debugger-common | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-doc | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-gdb | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-lldb | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-src | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-std-static | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-toolset | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rustfmt | 1.49.0-1.module+el8.4.0+416+259a129a |
Referencias
- https://access.redhat.com/errata/RHSA-2021:1935
- https://access.redhat.com/security/cve/CVE-2020-36318
- https://bugzilla.redhat.com/show_bug.cgi?id=1949189
- https://bugzilla.redhat.com/show_bug.cgi?id=1949192
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36317
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36318
- https://errata.rockylinux.org/RLSA-2021:1935