CVE-2022-36086 Explained : Impact and Mitigation

A detailed overview of the CVE-2022-36086 vulnerability affecting linked_list_allocator in rust-osdev.

Understanding CVE-2022-36086

This CVE highlights a vulnerability in linked_list_allocator that could lead to out-of-bound writes during heap initialization and the

Heap::extend

method.

What is CVE-2022-36086?

Prior to version 0.10.2, linked_list_allocator lacked a minimum size check for heap initialization, allowing out-of-bound writes when the heap size was smaller than

3 * size_of::<usize>

.

The Impact of CVE-2022-36086

The vulnerability affects various initialization functions on the

Heap

and

LockedHeap

, including

Heap::new

,

Heap::init

,

Heap::init_from_slice

, and

LockedHeap::new

. It also impacts multiple uses of the

Heap::extend

method.

Technical Details of CVE-2022-36086

An insight into the technical aspects of the CVE.

Vulnerability Description

linked_list_allocator prior to version 0.10.2 allows out-of-bound writes due to missing size checks during heap initialization, posing a risk to system integrity and data confidentiality.

Affected Systems and Versions

The vulnerability affects all systems running linked_list_allocator versions lower than 0.10.2.

Exploitation Mechanism

Attack complexity is low, requiring local access to exploit the vulnerability, leading to high impact on availability, confidentiality, and integrity without requiring special privileges.

Mitigation and Prevention

Strategies to mitigate and prevent the exploitation of CVE-2022-36086.

Immediate Steps to Take

Ensure that heap initialization sizes are larger than

3 * size_of::<usize>

and

Heap::extend

method calls are made with sizes larger than

2 * size_of::<usize>()

.

Long-Term Security Practices

Regularly update linked_list_allocator to version 0.10.2 and maintain a heap size multiple of

2 * size_of::<usize>()

to prevent out-of-bound writes.

Patching and Updates

Version 0.10.2 includes a patch for the vulnerability. It is essential to promptly update linked_list_allocator to this version to eliminate the risk of out-of-bound writes.