Skip to content
Fencer Vulns
high 8.4

CVE-2022-36086 json

linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`

published 2022-09-07 4 y ago modified 2026-10-12 27 d ago also GHSA-xg8p-34w2-j49j , RUSTSEC-2022-0063 , EUVD-2022-6977

cvss
8.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::<usize>` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::<usize>` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::<usize>()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::<usize>()`.

Patch / fix

  • crates.io linked_list_allocator 0.10.2
  • rust-osdev linked-list-allocator 0.10.2
  • cargo-audit-advisory-db openSUSE Tumbleweed 20221102-1.1

opensuse advisories openSUSE-SU-2024:12469-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/rust-osdev/linked-list-allocator/security/advisories/GHSA-xg8p-34w2-j49j referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
crates.io linked_list_allocator
<0.10.2
>=0.0.0-0, <0.10.2
0.10.2

Affected products

  • rust-osdev linked-list-allocator

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-787 Out-of-bounds Write
  • CWE-1284 Improper Validation of Specified Quantity in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.