CVE-2018-1000810: Buffer Overflow

Published Oct 8, 2018

Updated

The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat, passed a large number, can overflow an internal buffer. This vulnerability appears to have been fixed in 1.29.1.

Affected Software

8 affected components

rust-lang Rust=1.26.0

rust-lang Rust=1.26.1

rust-lang Rust=1.26.2

rust-lang Rust=1.27.0

rust-lang Rust=1.27.1

rust-lang Rust=1.27.2

rust-lang Rust=1.28.0

rust-lang Rust=1.29.0

Remediation

Patch Available

https://groups.google.com/forum/#!topic/rustlang-security-announcements/CmSuTm-SaU0

Event History

Oct 8, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is CVE-2018-1000810?

CVE-2018-1000810 is a vulnerability in the Rust Programming Language Standard Library that allows for integer overflow to buffer overflow, potentially resulting in a buffer overflow attack.

What is the severity of CVE-2018-1000810?

CVE-2018-1000810 has a severity rating of 9.8, which is considered critical.

Which versions of Rust Programming Language Standard Library are affected by CVE-2018-1000810?

Versions 1.29.0, 1.28.0, 1.27.2, 1.27.1, 1.27.0, 1.26.2, 1.26.1, and 1.26.0 of the Rust Programming Language Standard Library are affected by CVE-2018-1000810.

How can I exploit CVE-2018-1000810?

CVE-2018-1000810 can be exploited through the str::repeat function.

Is there a fix available for CVE-2018-1000810?

Yes, the vulnerability has been patched in the Rust Programming Language Standard Library. It is recommended to update to a version that is not affected.