CVE-2019-16142 Improper Input Validation in renderdoc
The renderdoc Rust crate contains thread-unsafe methods that can cause undefined behavior in multi-threaded applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16142?
CVE-2019-16142 is a critical vulnerability in n/a, published on 9 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a multi-threaded application.
Weakness: CWE-20
Which versions are affected by CVE-2019-16142?
3 open source packages ship an affected version, including renderdoc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
renderdoc crates.io | All versions | 0.5.0 |
renderdoc crates.io | All versions | 0.5.0 |
renderdoc crates.io | From 0.0.0-0 | 0.5.0 |
Products include Renderdocs-Rs Project Renderdocs-Rs.
How do I fix CVE-2019-16142?
Upgrade renderdoc to 0.5.0 or later.
Is CVE-2019-16142 being exploited?
There is no known exploitation of CVE-2019-16142 in the wild and no public exploit code.
Sources
Also known as GHSA-vhfr-v4w9-45v8, RUSTSEC-2019-0018.