crates.io/rustix CVE-2024-43806: medium 6.5, EPSS 0.48%
rustix's `rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosion
Action: Upgrade rustix to 0.35.15 or later.
cargo update -p rustix --precise 0.35.15cargo update -p rustix --precise 0.36.16cargo update -p rustix --precise 0.37.25cargo update -p rustix --precise 0.38.19Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.35.11 | 0.35.15 | - |
| 0.36.0 | 0.36.16 | - |
| 0.37.0 | 0.37.25 | - |
| 0.38.0 | 0.38.19 | - |
Fixed versions
| 0.35.15 | 0.36.16 | 0.37.25 | 0.38.19 |
Sources
- osv: GHSA-c827-hfw6-qwvm
- https://github.com/bytecodealliance/rustix/security/advisories/GHSA-c827-hfw6-qwvm
- https://nvd.nist.gov/vuln/detail/CVE-2024-43806
- https://github.com/imsnif/bandwhich/issues/284
- https://github.com/imsnif/bandwhich/issues/284#issuecomment-1754321993
- https://github.com/bytecodealliance/rustix/commit/31fd98ca723b93cc6101a3e29843ea5cf094e159
- https://github.com/bytecodealliance/rustix/commit/87481a97f4364d12d5d6f30cdd025a0fc509b8ec
- https://github.com/bytecodealliance/rustix/commit/df3c3a192cf144af0da8a57417fb4addbdc611f6
- https://github.com/bytecodealliance/rustix/commit/eecece4a84fc58eafdc809cc2cedd374dee876a5
- https://discord.com/channels/273534239310479360/1161137828395237556
- https://github.com/bytecodealliance/rustix
CVE-2024-43806 · published · modified · JSON