-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from HashTable API methods that performed insufficient bounds checking. The patch adds critical validation against the actual section size (via 'bounds' field). The pre-patch versions of get_bucket and get_chain only checked against count fields that could be controlled by malicious ELF files. These functions would appear in profilers when processing malicious inputs due to their direct role in hash table index access. The ASan trace in the issue report specifically implicates get_bucket, and the symmetrical nature of get_chain indicates both were vulnerable.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| xmas-elf | rust | < 0.10 | 0.10 |
RustRustKEV Misses 88% of Exploited CVEs- Get the report