« Volver al listado

CVE-2018-1000810

Estado: ModificadaCrítica (9.8)—

The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat, passed a large number, can overflow an internal buffer. This vulnerability appears to have been fixed in 1.29.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rust-lang — Rust

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-1000810",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-10-08T15:29:01.227",
  "references": [
    {
      "url": "https://blog.rust-lang.org/2018/09/21/Security-advisory-for-std.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://groups.google.com/forum/#%21topic/rustlang-security-announcements/CmSuTm-SaU0",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201812-11",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://blog.rust-lang.org/2018/09/21/Security-advisory-for-std.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://groups.google.com/forum/#%21topic/rustlang-security-announcements/CmSuTm-SaU0",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201812-11",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat, passed a large number, can overflow an internal buffer. This vulnerability appears to have been fixed in 1.29.1."
    },
    {
      "lang": "es",
      "value": "Rust Programming Language Standard Library en versiones 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1 y 126.0 contiene una vulnerabilidad CWE-680: desbordamiento de enteros a desbordamiento de búfer en la biblioteca estándar que puede resultar en un desbordamiento de búfer. El ataque parece ser explotable mediante str::repeat (al pasar un número grande, puede desbordar un búfer interno). La vulnerabilidad parece haber sido solucionada en la versión 1.29.1."
    }
  ],
  "lastModified": "2026-06-17T01:33:05.623",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rust-lang:rust:1.26.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9AF229B-ECC0-4F46-AF1A-77C1CD8BB58F"
            },
            {
              "criteria": "cpe:2.3:a:rust-lang:rust:1.26.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95E94B22-EE10-4570-8B3F-45A759066CEE"
            },
            {
              "criteria": "cpe:2.3:a:rust-lang:rust:1.26.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "299B479F-4789-47CA-A4B3-7A92CE0418DD"
            },
            {
              "criteria": "cpe:2.3:a:rust-lang:rust:1.27.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E49924E-AA39-46A5-92B6-7572DFD9FD79"
            },
            {
              "criteria": "cpe:2.3:a:rust-lang:rust:1.27.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D6CF2A0-DE73-4985-B36F-C584EE90163D"
            },
            {
              "criteria": "cpe:2.3:a:rust-lang:rust:1.27.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E692D271-1DC5-4019-8D4C-4892DB98A74E"
            },
            {
              "criteria": "cpe:2.3:a:rust-lang:rust:1.28.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D90B449-1275-453A-AA87-7A7D556E1A3D"
            },
            {
              "criteria": "cpe:2.3:a:rust-lang:rust:1.29.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2800E9C4-EFD3-47A8-B432-89D3C85A70D2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}