Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6654: Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | cargo | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | cargo-debuginfo | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | clippy | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | clippy-debuginfo | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-analyzer | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-analyzer-debuginfo | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-debugger-common | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-debuginfo | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-debugsource | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-doc | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-gdb | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-lldb | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-src | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-std-static | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-std-static-wasm32-unknown-unknown | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-std-static-wasm32-wasip1 | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-toolset | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rust-toolset-srpm-macros | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rustfmt | 0:1.95.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | rustfmt-debuginfo | 0:1.95.0-1.amzn2023.0.2 |
Vulnerabilities 1
-
Medium 5.1
Use-After-Free and Double-Free in IntoIter::drop when element drop panics
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-6654.html