rustc: Backport the fix for Rust#44800 to stretch (CVE-2018-1000657)

Debian Bug report logs - #906585
rustc: Backport the fix for Rust#44800 to stretch (CVE-2018-1000657)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>

To: submit@bugs.debian.org

Subject: rustc: Backport the fix for Rust#44800 to stretch

Date: Sat, 18 Aug 2018 15:19:46 +0200

[Message part 1 (text/plain, inline)]

Source: rustc
Version: 1.14.0+dfsg1-3
Severity: important
Tags: security stretch

Hi,

Sergey (in CC) recently pointed out [0] that we are still shipping in Stretch
i386 a version of the VecDeque (from the Rust stdlib) that can perform invalid
out-of-bounds writes:

  https://github.com/rust-lang/rust/issues/44800

This is very likely exploitable (attacker-controlled data is written outside
the buffer), and we (the rust team) think it would be worth fixing ASAP.


Thankfully, there is already a more recent version for amd64 in stretch, and
1.24.1+dfsg1-1~deb9u3 is already in stretch-pu for i386 (plus a bunch of
architectures which did not previously have rustc).  The fix first appeared in
upstream release 1.21.0 (Oct 2017).

Would it be possible to turn it into a security upload, along with a binNMU of
all packages that were built with rustc (<< 1.24.1) ?


@Sergey: Thanks a lot for dedicating some of your time and energy to finding
         security issues in the Rust ecosystem, it is highly appreciated.  :3


Best,

  nicoo


[0]: https://medium.com/@shnatsel/how-rusts-standard-library-was-vulnerable-for-years-and-nobody-noticed-aebf0503c3d6

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 906585@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>, 906585@bugs.debian.org

Subject: Re: Bug#906585: rustc: Backport the fix for Rust#44800 to stretch

Date: Sun, 19 Aug 2018 12:04:25 +0200

On Sat, Aug 18, 2018 at 03:19:46PM +0200, Nicolas Braud-Santoni wrote:
> Source: rustc
> Version: 1.14.0+dfsg1-3
> Severity: important
> Tags: security stretch
> 
> Hi,
> 
> Sergey (in CC) recently pointed out [0] that we are still shipping in Stretch
> i386 a version of the VecDeque (from the Rust stdlib) that can perform invalid
> out-of-bounds writes:
> 
>   https://github.com/rust-lang/rust/issues/44800
> 
> This is very likely exploitable (attacker-controlled data is written outside
> the buffer), and we (the rust team) think it would be worth fixing ASAP.
> 
> 
> Thankfully, there is already a more recent version for amd64 in stretch, and
> 1.24.1+dfsg1-1~deb9u3 is already in stretch-pu for i386 (plus a bunch of
> architectures which did not previously have rustc).  The fix first appeared in
> upstream release 1.21.0 (Oct 2017).
> 
> Would it be possible to turn it into a security upload, along with a binNMU of
> all packages that were built with rustc (<< 1.24.1) ?

1.24 will reach stretch via the next 9.5 point release. I don't see any
need to expedite this. Do we actually have any application in stretch yet which
is written in Rust?

Cheers,
        Moritz

Message #15 received at 906585@bugs.debian.org (full text, mbox, reply):

From: Angus Lees <gus@debian.org>

To: Moritz Mühlenhoff <jmm@inutil.org>, 906585@bugs.debian.org

Cc: Nicolas Braud-Santoni <nicolas@braud-santoni.eu>

Subject: Re: [Pkg-rust-maintainers] Bug#906585: rustc: Backport the fix for Rust#44800 to stretch

Date: Tue, 21 Aug 2018 12:26:22 +1000

[Message part 1 (text/plain, inline)]

On Sun, 19 Aug 2018 at 20:39 Moritz Mühlenhoff <jmm@inutil.org> wrote:

> On Sat, Aug 18, 2018 at 03:19:46PM +0200, Nicolas Braud-Santoni wrote:
> > Would it be possible to turn it into a security upload, along with a
> binNMU of
> > all packages that were built with rustc (<< 1.24.1) ?
>
> 1.24 will reach stretch via the next 9.5 point release. I don't see any
> need to expedite this. Do we actually have any application in stretch yet
> which
> is written in Rust?
>

No, not in stretch (other than the rustc/libstd-rust toolchain itself).

 - Gus

[Message part 2 (text/html, inline)]

Message #26 received at 906585-done@bugs.debian.org (full text, mbox, reply):

From: Andreas Beckmann <anbe@debian.org>

To: 906585-done@bugs.debian.org

Subject: Re: Bug#906585: rustc: Backport the fix for Rust#44800 to stretch

Date: Sat, 4 May 2019 11:16:04 +0200

Version: 1.24.1+dfsg1-1~deb9u4

On Sun, 19 Aug 2018 12:04:25 +0200 =?UTF-8?Q?Moritz_M=C3=BChlenhoff?=
<jmm@inutil.org> wrote:
> 1.24 will reach stretch via the next 9.5 point release. I don't see any

which happened some time ago


Andreas

Send a report that this bug log contains spam.