CVE-2018-25023

HIGH7.5EPSS 0.23%

smallvec creates uninitialized value of any type

Published: 1/6/2022Modified: 11/8/2023
Also known as:GHSA-55m5-whcv-c49cGHSA-66p5-j55p-32r9DEBIAN-CVE-2018-25023RUSTSEC-2018-0018

Description

Affected versions of this crate called `mem::uninitialized()` to create values of a user-supplied type `T`. This is unsound e.g. if `T` is a reference type (which must be non-null and thus may not remain uninitialized). The flaw was corrected by avoiding the use of `mem::uninitialized()`, using `MaybeUninit` instead.

Affected packages (4)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References (9)