CVE-2018-20998

描述

The attribute repr() added to enums to be compatible with C-FFI caused memory corruption on MSVC toolchain. arrayfire crates <= version 3.5.0 do not have this issue when used with Rust versions 1.27 or earlier. The issue only started to appear since Rust version 1.28. The issue seems to be interlinked with which version of Rust is being used. The issue was fixed in crate 3.6.0.

如何修補 CVE-2018-20998

要修補 CVE-2018-20998,請將受影響套件升級到下列已修補版本。

• —升級至 3.6.0 或更新版本
• —升級至 3.6.0 或更新版本
• —升級至 3.6.0 或更新版本
• —升級至 3.6.0 或更新版本

CVE-2018-20998 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 3.6.0
• >= 3.5.1-0, < 3.6.0
• from 0, < 3.6.0
• from 0, < 3.6.0

CVSS 分數

參考連結(8)

• ADVISORYgithub.com/advisories/GHSA-69fv-gw6g-8ccg
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-20998
• PATCHcrates.io/crates/arrayfire
• PATCHgithub.com/arrayfire/arrayfire-rust
• WEB