GHSA-8fgg-5v78-6g76

Source

https://github.com/advisories/GHSA-8fgg-5v78-6g76

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-8fgg-5v78-6g76/GHSA-8fgg-5v78-6g76.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8fgg-5v78-6g76

Aliases

CVE-2021-28033
RUSTSEC-2021-0032

Published

2021-08-25T20:52:03Z

Modified

2023-11-08T04:05:27.850049Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Deserializing an array can free uninitialized memory in byte_struct

Details

Bytestruct stack and unpack structure as raw bytes with packed or bit field layout. An issue was discovered in the bytestruct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics.

Database specific

{
    "cwe_ids": [
        "CWE-119",
        "CWE-908"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-19T17:25:30Z",
    "nvd_published_at": "2021-03-05T09:15:00Z",
    "severity": "CRITICAL"
}

References

Affected packages

crates.io / byte_struct

Package

Name: byte_struct; View open source insights on deps.dev
Purl: pkg:cargo/byte_struct

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.6.1