CVE-2019-16881

Published: Sep 25, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust. There is a use-after-free with resultant arbitrary code execution because of a lack of unwind safety in stream_callback and stream_finished_callback.

Affected (1)

Products: Portaudio Rs Project: Portaudio Rs

Portaudio Rs Project

1 product

Portaudio Rs

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Portaudio Rs Project Portaudio Rs	Up to 0.3.1

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (2)

https://rustsec.org/advisories/RUSTSEC-2019-0022.html

Source: cve@mitre.org

ExploitThird Party Advisory

https://rustsec.org/advisories/RUSTSEC-2019-0022.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.