GHSA-qgwf-r2jj-2ccv

Use after free in heapless

Source: GitHub Advisory Database (reviewed) High CVE-2020-36464

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	heapless	< 0.6.1	0.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the heapless crate before 0.6.1 for Rust. The IntoIter Clone implementation clones an entire underlying Vec without considering whether it has already been partially consumed.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36464 advisory
https://github.com/japaric/heapless/issues/181 web
https://github.com/japaric/heapless package
https://rustsec.org/advisories/RUSTSEC-2020-0145.html web