An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.
References
Link | Resource |
---|---|
https://rustsec.org/advisories/RUSTSEC-2021-0015.html | Exploit Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2021-02-09T22:07:49
Updated: 2021-02-09T22:07:49
Reserved: 2021-02-09T00:00:00
Link: CVE-2021-26951
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-02-09T23:15:13.663
Modified: 2022-04-25T20:16:31.450
Link: CVE-2021-26951
JSON object: View
Redhat Information
No data.