High, CVSS 8.4crates.ioPublished
linked_list_allocator vulnerable to out-of-bound writes on Heap initialization and Heap::extend
CVE-2022-36086 · GHSA-xg8p-34w2-j49j
- Affected
- crates.io linked_list_allocator <= 0.10.1
- Fixed in
- 0.10.2· Vendor fix available
- Issue
- Impact What kind of vulnerability is it? Who is impacted? This vulnerability impacts all the initialization functions on the Heap and LockedHeap types, including Heap::new, Heap::init, Heap::initfromslice, and LockedHeap::new. It also affects multiple uses of the Heap::extend method. Initialization Functions The heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than 3 sizeof::<usize because of metadata write operations. Heap::extend This vulnerability impacts three specific uses of the Heap::extend method: - When calling Heap::extend with a size smaller than two usizes (e.g., 16 on x8664), the size was erroneously rounded up to the minimum size, which could result in an out-of-bounds write. - Calling Heap::extend on an empty heap tried to construct a heap starting at address 0, which is also an out-of-bounds write. - One specific way to trigger this…
Recommended action: Upgrade to 0.10.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.