HIGH7.5

GHSA-qgwf-r2jj-2ccv

Use after free in heapless

Details

An issue was discovered in the heapless crate before 0.6.1 for Rust. The IntoIter Clone implementation clones an entire underlying Vec without considering whether it has already been partially consumed.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/heapless

Introduced in: 0Fixed in: 0.6.1

Upgrade heapless to 0.6.1 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2020-36464[ADVISORY]
https://github.com/japaric/heapless/issues/181[WEB]
https://github.com/japaric/heapless[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2020-0145.html[WEB]