The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.

  • Published Date: Monday 13th of May 2019 04:29:02 PM
  • Modified Date: Tuesday 14th of May 2019 12:28:43 PM
    • Network Access Vector: The attacker does not require local network access or local access.
    • Authentication Vector: Authentication is not required to access and exploit the vulnerability.
    • Complexity Vector: One instance of complexity is required to access and exploit the vulnerability.
    • Availability Impact: There is reduced performance or interruptions in resource availability.
    • Integrity Impact: Modification of some system files is posible.
    • Confidentiality Impact: There is considerable information disclosure.
    • CVSS Score: 6.8
    • Common Platform Enumeration (CPE) Dictionary
      • cpe:2.3:a:rust-lang:rust:1.34.0
      • cpe:2.3:a:rust-lang:rust:1.34.1
    • Reference:

    Download Mageni's Vulnerability Scanning Platform.

    No credit card is required to download the Free Edition. Register now.