GHSA-66p5-j55p-32r9 CVE-2018-25023 GHSA-55m5-whcv-c49c RUSTSEC-2018-0018
smallvec creates uninitialized value of any type
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.42%
- Chance of exploitation in the next 30 days. Higher than 72.89% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-457 Use of Uninitialized Variable
- Fix
0.6.13- Upgrade smallvec to this version or later
Description
Affected versions of this crate called mem::uninitialized() to create values of a user-supplied type T.
This is unsound e.g. if T is a reference type (which must be non-null and thus may not remain uninitialized).
The flaw was corrected by avoiding the use of mem::uninitialized(), using MaybeUninit instead.
Affected versions
crates.io
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
smallvec crates.io → 0.6.13
- cargo
cargo update -p smallvec --precise 0.6.13
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-457: Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
How to prevent it
- Implementation: Ensure that critical variables are initialized before first use [REF-1485].
- Build and Compilation: Most compilers will complain about the use of uninitialized variables if warnings are turned on.
- Implementation, Operation: When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.
- Requirements: Choose a language that is not susceptible to these issues.
- Architecture and Design: Mitigating technologies such as safe string libraries and container abstractions could be introduced.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-43w2-9j62-hq99 Buffer overflow in SmallVec::insert_many | Critical | Also affects smallvec |
| GHSA-69gw-hgj3-45m7 Memory corruption in smallvec | Critical | Also affects smallvec |
| GHSA-mm7v-vpv8-xfc3 Double free in smallvec | Critical | Also affects smallvec |
| GHSA-rxr4-x558-x7hw Double free in smallvec | Critical | Also affects smallvec |
| GHSA-rfgq-q3w2-pmv2 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory | Medium | Same weakness, CWE-457 |
| GHSA-j4m9-6w36-pw47 Pillow: Invalid free in FreeType glyph rendering when a stroker is active | High | Same weakness, CWE-457 |
| GHSA-r53h-jv2g-vpx6 Helm's Missing YAML Content Leads To Panic | High | Same weakness, CWE-457 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor