linked_list_allocator up to 0.10.1 extend out-of-bounds write

Summaryinfo

A vulnerability, which was classified as critical, was found in linked_list_allocator up to 0.10.1. Affected by this vulnerability is the function Heap::new/Heap::init/Heap::init_from_slice/LockedHeap::new/Heap::extend. The manipulation results in out-of-bounds write. This vulnerability was named CVE-2022-36086. The attack needs to be approached locally. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in linked_list_allocator up to 0.10.1. Affected is the function Heap::new/Heap::init/Heap::init_from_slice/LockedHeap::new/Heap::extend. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::<usize>` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::<usize>` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::<usize>()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::<usize>()`.

The weakness was presented 09/08/2022 as GHSA-xg8p-34w2-j49j. The advisory is available at github.com. This vulnerability is traded as CVE-2022-36086 since 07/15/2022. Technical details are known, but there is no available exploit.

Upgrading to version 0.10.2 eliminates this vulnerability. Applying the patch 013b0758643943e8df5b17bbb495460ff47e8bbf is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• linked_list_allocator

Version

• 0.10.0
• 0.10.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion