Description
The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | rust | 1.36.0-4.1 | SUSE-SU-2019:2755-1 |
| SLES 15 | rust | 1.36.0-3.21.1 | SUSE-SU-2019:2439-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rust1.53 | 1.53.0-2.5 | openSUSE-SU-2024:11360-1 |
| openSUSE Leap 15.1 | rust | 1.36.0-lp151.5.4.1 | openSUSE-SU-2019:2294-1, openSUSE-SU-2019:2244-1, openSUSE-SU-2019:2203-1 |
| openSUSE Leap 15.1 | rust-cbindgen | 0.8.7-lp151.2.2 | openSUSE-SU-2019:2294-1, openSUSE-SU-2019:2203-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | rust +1 | 1.34.2-r0 | — |
| Alpine v3.23 | rust | 1.34.2-r0 | — |
| Alpine v3.22 | rust | 1.34.2-r0 | — |
| Alpine v3.21 | rust | 1.34.2-r0 | — |
| Alpine v3.20 | rust | 1.34.2-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | rust | 1.34.2-r0 | — |
| Alpine v3.18 | rust | 1.34.2-r0 | — |
| Alpine v3.17 | rust | 1.34.2-r0 | — |
| Alpine v3.16 | rust | 1.34.2-r0 | — |
| Alpine v3.15 | rust | 1.34.2-r0 | — |
| Alpine v3.14 | rust | 1.34.2-r0 | — |
| Alpine v3.13 | rust | 1.34.2-r0 | — |
| Alpine v3.12 | rust | 1.34.2-r0 | — |
| Alpine v3.11 | rust | 1.34.2-r0 | — |
Advisories 6
- openSUSE-SU-2024:11360-1 cargo1.53-1.53.0-2.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2294-1 Security update for rust SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2755-1 Security update for rust SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2203-1 Security update for rust SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2244-1 Security update for rust SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2439-1 Security update for rust SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://groups.google.com/forum/#%21topic/rustlang-security-announcements/aZabeCMUv70
- https://blog.rust-lang.org/2019/05/13/Security-advisory.html
- FEDORA-2019-e39d4910c6 vendor-advisory
- FEDORA-2019-f76f0e11b3 vendor-advisory
- openSUSE-SU-2019:2203 vendor-advisory
- openSUSE-SU-2019:2244 vendor-advisory
- openSUSE-SU-2019:2294 vendor-advisory