CVE-2020-15254highCWE-119

CVE-2020-15254: falha de alta gravidade em crossbeam-rs crossbeam

Undefined Behavior in bounded Crossbeam channel

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar crossbeam+ Monitorar firefox

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 2.7%
Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
crossbeam-rs · crossbeam
CVEs relacionadas — crossbeam-rs crossbeam

No mesmo produto, das mais perigosas para as menos.

CVE-2021-32810CRITICALData race in crossbeam-dequeEPSS 1.9%CVE-2022-23639HIGHImproper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utilsEPSS 1.2%