CVE-2019-25054 Missing Initialization of Resource in pnet
A segmentation fault in the pnet crate allows attackers to cause a denial of service via uninitialized descriptor dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-25054?
CVE-2019-25054 is a high-severity vulnerability in n/a, published on 26 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization.
Weakness: CWE-909
Which versions are affected by CVE-2019-25054?
5 open source packages ship an affected version, including pnet. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pnet crates.io | All versions | 0.27.2 |
pnet crates.io | All versions | 0.27.2 |
pnet crates.io | All versions | 0.27.2 |
pnet crates.io | All versions | 0.27.2 |
pnet crates.io | From 0.0.0-0 | 0.27.2 |
Products include Pnet Project Pnet.
How do I fix CVE-2019-25054?
Upgrade pnet to 0.27.2 or later.
Is CVE-2019-25054 being exploited?
There is no known exploitation of CVE-2019-25054 in the wild and no public exploit code.
Sources
Also known as GHSA-24g6-5rx7-58wj, GHSA-r6ff-2q3c-v3pv, RUSTSEC-2019-0037.