In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.

An update of the rust package has been released.

The version of rust installed on the remote host is prior to 1.56.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1816 advisory.

  - In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause     uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its     length is checked. (CVE-2020-36323)

  - In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls
    __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in     certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement     for the TrustedRandomAccess trait. (CVE-2021-28876)

  - In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked()     more than once for the same index (under certain conditions) when next_back() and next() are used     together. This bug could lead to a memory safety violation due to an unmet safety requirement for the     TrustedRandomAccess trait. (CVE-2021-28878)

  - In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to     an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.
    (CVE-2021-28879)

  - In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if     freeing the element panics. (CVE-2021-31162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:3063 advisory.

  - In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause     uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its     length is checked. (CVE-2020-36323)

  - In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read     in an unsafe context. This bug could lead to a buffer overflow. (CVE-2021-28875)

  - In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls
    __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in     certain conditions). This bug could lead to a memory safety violation due to an unmet safety requirement     for the TrustedRandomAccess trait. (CVE-2021-28876)

  - In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for     the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet     safety requirement for the TrustedRandomAccess trait. (CVE-2021-28877)

  - In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked()     more than once for the same index (under certain conditions) when next_back() and next() are used     together. This bug could lead to a memory safety violation due to an unmet safety requirement for the     TrustedRandomAccess trait. (CVE-2021-28878)

  - In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to     an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again.
    (CVE-2021-28879)

  - In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if     freeing the element panics. (CVE-2021-31162)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3063 advisory.

  - rust: optimization for joining strings can cause uninitialized bytes to be exposed (CVE-2020-36323)

  - rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read     in an unsafe context (CVE-2021-28875)

  - rust: panic safety issue in Zip implementation (CVE-2021-28876)

  - rust: memory safety violation in Zip implementation for nested iter::Zips (CVE-2021-28877)

  - rust: memory safety violation in Zip implementation when next_back() and next() are used together     (CVE-2021-28878)

  - rust: integer overflow in the Zip implementation can lead to a buffer overflow (CVE-2021-28879)

  - rust: double free in Vec::from_iter function if freeing the element panics (CVE-2021-31162)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3063 advisory.

    - Update to 1.52.1. Includes security fixes for CVE-2020-36323,       CVE-2021-28876, CVE-2021-28878, CVE-2021-28879, and CVE-2021-31162.
    - Update to 1.51.0. Update to 1.51.0. Includes security fixes for       CVE-2021-28875 and CVE-2021-28877.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3063 advisory.

    Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency     manager, and required libraries.

    The following packages have been upgraded to a later upstream version: rust (1.52.1). (BZ#1953002)

    Security Fix(es):

    * rust: optimization for joining strings can cause uninitialized bytes to be exposed (CVE-2020-36323)

    * rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from     Read in an unsafe context (CVE-2021-28875)

    * rust: panic safety issue in Zip implementation (CVE-2021-28876)

    * rust: memory safety violation in Zip implementation for nested iter::Zips (CVE-2021-28877)

    * rust: memory safety violation in Zip implementation when next_back() and next() are used together     (CVE-2021-28878)

    * rust: integer overflow in the Zip implementation can lead to a buffer overflow (CVE-2021-28879)

    * rust: double free in Vec::from_iter function if freeing the element panics (CVE-2021-31162)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For information on usage, see Using Rust Toolset linked in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3042 advisory.

    Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency     manager, the cargo-vendor plugin, and required libraries.

    The following packages have been upgraded to a later upstream version: rust-toolset-1.52-rust (1.52.1).
    (BZ#1947197)

    Security Fix(es):

    * rust: optimization for joining strings can cause uninitialized bytes to be exposed (CVE-2020-36323)

    * rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from     Read in an unsafe context (CVE-2021-28875)

    * rust: panic safety issue in Zip implementation (CVE-2021-28876)

    * rust: memory safety violation in Zip implementation for nested iter::Zips (CVE-2021-28877)

    * rust: memory safety violation in Zip implementation when next_back() and next() are used together     (CVE-2021-28878)

    * rust: integer overflow in the Zip implementation can lead to a buffer overflow (CVE-2021-28879)

    * rust: double free in Vec::from_iter function if freeing the element panics (CVE-2021-31162)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For information on usage, see Using Rust Toolset linked in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203212	Photon OS 4.0: Rust PHSA-2021-4.0-0019	Nessus	PhotonOS Local Security Checks	high
163234	Amazon Linux 2 : rust (ALAS-2022-1816)	Nessus	Amazon Linux Local Security Checks	critical
157792	Rocky Linux 8 : rust-toolset:rhel8 (RLSA-2021:3063)	Nessus	Rocky Linux Local Security Checks	critical
152574	CentOS 8 : rust-toolset:rhel8 (CESA-2021:3063)	Nessus	CentOS Local Security Checks	critical
152509	Oracle Linux 8 : rust-toolset:ol8 (ELSA-2021-3063)	Nessus	Oracle Linux Local Security Checks	critical
152449	RHEL 8 : rust-toolset:rhel8 (RHSA-2021:3063)	Nessus	Red Hat Local Security Checks	critical
152446	RHEL 7 : rust-toolset-1.52 and rust-toolset-1.52-rust (RHSA-2021:3042)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2020-36323

high

Tenable Plugins

high

critical

critical

critical

critical

critical

critical