RUSTSEC-2018-0022

    Dashboard / Vulnerabilities / RUSTSEC-2018-0022

    RUSTSEC-2018-0022

    Published: 22 Aug 2018Last Modified: 8 Nov 2023

    Summary: Use of uninitialized memory in temporary

    Details: Uninit memory is used as a RNG seed in temporary The following function is used as a way to get entropy from the system, which does operations on and exposes uninit memory, which is UB. ```rust fn random_seed(_: &Path, _: &str) -> [u64; 2] { use std::mem::uninitialized as rand; unsafe { [rand::<u64>() ^ 0x12345678, rand::<u64>() ^ 0x87654321] } } ``` This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, [`tempfile`](https://crates.io/crates/tempfile) is an alternative for this crate.

    References: https://crates.io/crates/temporary, https://rustsec.org/advisories/RUSTSEC-2018-0022.html, https://github.com/stainless-steel/temporary/issues/2

    Affected packages

    Package

    Name: temporary

    Purl: pkg:cargo/temporary

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.3.0
    Fixed -0.6.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High