Is CVE-2018-25024 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-25024 being exploited in the wild.

How severe is CVE-2018-25024?

Critical severity, with a CVSS score of 9.8, published 6 January 2022.

Which products and versions are affected?

actix-web (crates.io) < 0.7.19, SEMVER:introduced=0,fixed=0.7.19, SEMVER:introduced=0.0.0-0,fixed=0.7.20-0.

Is there a fix for CVE-2018-25024?

Yes. actix-web (crates.io): upgrade to 0.7.19, 0.7.20-0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-25024 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-25024?

Check whether you run actix-web (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-25024: actix-web memory corruption via unsound reference coercion

Q: Is there a fix for CVE-2018-25024?

Yes. actix-web (crates.io): upgrade to 0.7.19, 0.7.20-0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2018-25024 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2018-25024?

Check whether you run actix-web (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-25024 · Severity: critical · CVSS 9.8 · Published 2022-01-06

actix-web is a popular framework used to build high-performance web servers in the Rust programming language. A security flaw was identified where the framework incorrectly handles internal data references, potentially allowing an attacker to corrupt the server's memory. This could lead to system crashes, unauthorized data access, or the execution of malicious code on the server.

Technologies: actix-web (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2018-25024 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-25024 being exploited in the wild.
How severe is CVE-2018-25024?: Critical severity, with a CVSS score of 9.8, published 6 January 2022.
Which products and versions are affected?: actix-web (crates.io) < 0.7.19, SEMVER:introduced=0,fixed=0.7.19, SEMVER:introduced=0.0.0-0,fixed=0.7.20-0.
Is there a fix for CVE-2018-25024?: Yes. actix-web (crates.io): upgrade to 0.7.19, 0.7.20-0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-25024 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-25024?: Check whether you run actix-web (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

actix-web (crates.io): upgrade to 0.7.19, 0.7.20-0 or later
```
cargo update -p actix-web
```

Technical details

The actix-web crate prior to version 0.7.19 contains several unsound uses of 'unsafe' Rust code. Specifically, the framework was found to unsoundly coerce immutable references into mutable references, incorrectly extend the lifetimes of strings, and inappropriately apply the 'Send' marker trait to objects that are not thread-safe. These flaws break Rust's memory safety guarantees, potentially leading to out-of-bounds writes and use-after-free vulnerabilities. An attacker could exploit these issues via network requests to cause memory corruption, leading to arbitrary code execution or a denial-of-service (DoS) condition. The issues were addressed through a significant refactoring of the codebase to remove or secure unsafe blocks.

Affected products

actix actix-web < 0.7.19

Identifiers

CVE-2018-25024
GHSA-7x36-h62w-vw65
GHSA-9qj6-4rfq-vm84
GHSA-fgfm-hqjw-3265
GHSA-w65j-g6c7-g3m4
RUSTSEC-2018-0019

Timeline

2018-06-08: disclosed: Initial tracking issue for unsound unsafe usage opened
2018-06-08: patched: Version 0.7.19 released with fixes
2021-12-27: advisory: NVD published CVE-2018-25024
2022-01-06: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.