CVE-2022-36086 linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`
An attacker can trigger out-of-bound writes in the linked_list_allocator library by initializing a heap with an insufficient size, potentially leading to memory corruption or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36086?
CVE-2022-36086 is a high-severity memory corruption vulnerability in rust-osdev linked-list-allocator, published on 7 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::<usize>` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::<usize>` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::<usize>()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::<usize>()`.
Which versions are affected by CVE-2022-36086?
3 open source packages ship an affected version, including linked_list_allocator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
linked_list_allocator crates.io | All versions | 0.10.2 |
linked_list_allocator crates.io | All versions | 0.10.2 |
linked_list_allocator crates.io | From 0.0.0-0 | 0.10.2 |
Products include Rust-Osdev Linked-List-Allocator.
How do I fix CVE-2022-36086?
Upgrade linked_list_allocator to 0.10.2 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-36086 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36086 exists.
Sources
Also known as GHSA-xg8p-34w2-j49j, RUSTSEC-2022-0063.