RUSTSEC-2021-0015

    Dashboard / Vulnerabilities / RUSTSEC-2021-0015

    RUSTSEC-2021-0015

    Published: 6 Jan 2021Last Modified: 8 Nov 2023

    Summary: `Sectors::get` accesses unclaimed/uninitialized memory

    Details: Affected versions of this crate arbitrarily calls `Vec::set_len` to increase length of a vector without claiming more memory for the vector. Affected versions of this crate also calls user-provided `Read` on the uninitialized memory of the vector that was extended with `Vec::set_len`. This can overwrite active entities in adjacent heap memory and seems to be a major security issue. Also, calling user-provided `Read` on uninitialized memory is defined as UB in Rust.

    References: https://crates.io/crates/calamine, https://rustsec.org/advisories/RUSTSEC-2021-0015.html, https://github.com/tafia/calamine/issues/199

    Affected packages

    Package

    Name: calamine

    Purl: pkg:cargo/calamine

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -0.17.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2021-0015 | CVE-DB