{"id":"EUVD-2022-6977","enisaUuid":"3dcef9b5-cbc0-3184-82f0-b3acc6337d33","description":"linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::\u003cusize\u003e` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::\u003cusize\u003e` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::\u003cusize\u003e()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::\u003cusize\u003e()`.","datePublished":"Sep 7, 2022, 10:50:09 PM","dateUpdated":"Apr 22, 2025, 5:23:22 PM","baseScore":8.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/rust-osdev/linked-list-allocator/security/advisories/GHSA-xg8p-34w2-j49j\nhttps://github.com/rust-osdev/linked-list-allocator/commit/013b0758643943e8df5b17bbb495460ff47e8bbf\n","aliases":"CVE-2022-36086\nGHSA-xg8p-34w2-j49j\n","assigner":"GitHub_M","epss":0.86,"enisaIdProduct":[{"id":"5ea77eae-b92f-3987-83e3-d4d14b99c656","product":{"name":"linked-list-allocator","vendor":{"name":"rust-osdev"}},"product_version":"\u003c 0.10.2"}],"enisaIdVendor":[{"id":"8f93a447-7d3e-38e7-83db-5dbda397d341","vendor":{"name":"rust-osdev"}}],"enisaIdVulnerability":[{"id":"44a02005-9d7b-302d-93b2-d99088fa3ceb","vulnerability":{"id":"CVE-2022-36086","description":"linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::\u003cusize\u003e` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::\u003cusize\u003e` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::\u003cusize\u003e()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::\u003cusize\u003e()`.","datePublished":"Sep 7, 2022, 10:50:09 PM","dateUpdated":"Apr 22, 2025, 5:23:22 PM","status":"PUBLISHED","baseScore":8.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/rust-osdev/linked-list-allocator/security/advisories/GHSA-xg8p-34w2-j49j\nhttps://github.com/rust-osdev/linked-list-allocator/commit/013b0758643943e8df5b17bbb495460ff47e8bbf\n","enisa_id":"EUVD-2022-6977\n","assigner":"GitHub_M","epss":0.86,"dataProcessed":"Oct 30, 2026, 7:14:39 AM","vulnerabilityProduct":[{"id":"5358d033-a88a-4f9f-8dd9-a3475157801b","product":{"name":"linked-list-allocator","vendor":{"name":"rust-osdev"}},"product_version":"\u003c 0.10.2"},{"id":"80e764eb-0c70-3d55-a52a-84f49e88f195","product":{"name":"linked-list-allocator","vendor":{"name":"rust-osdev"}},"product_version":"\u003c 0.10.2"}],"vulnerabilityVendor":[{"id":"44f5cda1-313e-35f8-ae71-451e9294e42c","vendor":{"name":"rust-osdev"}}]}},{"id":"751cab66-8556-3974-ac1c-952ae7acf796","vulnerability":{"id":"GHSA-xg8p-34w2-j49j","description":"linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`","datePublished":"Sep 16, 2022, 5:41:33 PM","dateUpdated":"Sep 16, 2022, 5:41:33 PM","baseScore":null,"references":"https://github.com/rust-osdev/linked-list-allocator/security/advisories/GHSA-xg8p-34w2-j49j\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-36086\nhttps://github.com/rust-osdev/linked-list-allocator/commit/013b0758643943e8df5b17bbb495460ff47e8bbf\nhttps://github.com/advisories/GHSA-xg8p-34w2-j49j\nhttps://github.com/rust-osdev/linked-list-allocator\nhttps://rustsec.org/advisories/RUSTSEC-2022-0063.html\n","enisa_id":"EUVD-2022-6977\n","aliases":"CVE-2022-36086\nGHSA-xg8p-34w2-j49j\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:05:36 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"e7556158-7032-3a39-ad68-60a8e8aabf20","advisory":{"id":"openSUSE-SU-2024:12469-1","description":"cargo-audit-advisory-db-20221102-1.1 on GA media","summary":"cargo-audit-advisory-db-20221102-1.1 on GA media","datePublished":"Jun 15, 2024, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 8:39:26 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12469-1.json\nhttps://www.suse.com/security/cve/CVE-2022-3602/\nhttps://www.suse.com/security/cve/CVE-2022-36086/\nhttps://www.suse.com/security/cve/CVE-2022-3786/\n","aliases":"CVE-2022-3602\nCVE-2022-36086\nCVE-2022-3786\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1c05f839-ce9e-33ab-a834-d85d997aa520","product":{"name":"cargo-audit-advisory-db-20221102-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"22636ab6-b52e-346f-a193-b5563a7c6dd8","product":{"name":"cargo-audit-advisory-db-0:20221102-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"2f1fac98-9620-31a1-b442-4d7b020de560","product":{"name":"cargo-audit-advisory-db-0:20221102-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"385c7d11-7617-3355-a606-c049cc846ec2","product":{"name":"cargo-audit-advisory-db-20221102-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"4cc8b205-9b02-35ed-91d4-62504921bf89","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"b7869e3f-82f9-32fa-98ad-77294c4e0e6d","product":{"name":"cargo-audit-advisory-db-20221102-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d80ce636-d29b-3f93-8799-677a779e6a8d","product":{"name":"cargo-audit-advisory-db-0:20221102-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"e8cb7654-070d-3a20-a47e-76e536057096","product":{"name":"cargo-audit-advisory-db-0:20221102-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"f1eba3ee-e60b-3570-8cf6-5f91f1f6be8a","product":{"name":"cargo-audit-advisory-db-20221102-1.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}