kritik
CVE-2020-36318
rust: use-after-free or double free in VecDeque::make_contiguous
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, CBL-Mariner. Daha düşük diyenler: Red Hat (orta), Oracle (düşük), Rocky Linux (düşük).
Açıklama
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| CBL-Mariner 1.0 | rust | 0:1.59.0-1.cm1 |
| debian 10 | rustc | düzeltme belirtilmemiş |
| debian 11 | rustc | düzeltme belirtilmemiş |
| debian 12 | rustc | 1.53.0+dfsg1-1 |
| debian 13 | rustc | 1.53.0+dfsg1-1 |
| debian 14 | rustc | 1.53.0+dfsg1-1 |
| debian 9 | rustc | düzeltme belirtilmemiş |
| echo | rustc | 1.53.0+dfsg1-1 |
| Oracle Linux 8 | cargo, cargo-doc, clippy ve 11 tane daha | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| rocky 8 | rust-toolset:rhel8::cargo, rust-toolset:rhel8::cargo-doc, rust-toolset:rhel8::clippy ve 11 tane daha | 1.49.0-1.module+el8.4.0+416+259a129a |
10 kaynaktaki 36 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| CBL-Mariner 1.0 | rust | 0:1.59.0-1.cm1 |
| debian 10 | rustc | düzeltme belirtilmemiş |
| debian 11 | rustc | düzeltme belirtilmemiş |
| debian 12 | rustc | 1.53.0+dfsg1-1 |
| debian 13 | rustc | 1.53.0+dfsg1-1 |
| debian 14 | rustc | 1.53.0+dfsg1-1 |
| debian 9 | rustc | düzeltme belirtilmemiş |
| echo | rustc | 1.53.0+dfsg1-1 |
| Oracle Linux 8 | cargo | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | cargo-doc | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | clippy | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rls | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-analysis | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-debugger-common | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-doc | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-gdb | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-lldb | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-src | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-std-static | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rust-toolset | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| Oracle Linux 8 | rustfmt | 1.49.0-1.module+el8.4.0+20083+9f8f961d |
| rocky 8 | rust-toolset:rhel8::cargo | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::cargo-doc | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::clippy | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rls | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-analysis | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-debugger-common | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-doc | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-gdb | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-lldb | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-src | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-std-static | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rust-toolset | 1.49.0-1.module+el8.4.0+416+259a129a |
| rocky 8 | rust-toolset:rhel8::rustfmt | 1.49.0-1.module+el8.4.0+416+259a129a |
Referanslar
- https://access.redhat.com/errata/RHSA-2021:1935
- https://access.redhat.com/security/cve/CVE-2020-36318
- https://bugzilla.redhat.com/show_bug.cgi?id=1949189
- https://bugzilla.redhat.com/show_bug.cgi?id=1949192
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36317
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36318
- https://errata.rockylinux.org/RLSA-2021:1935