GHSA-h7h7-6mx3-r89v

Source

https://github.com/advisories/GHSA-h7h7-6mx3-r89v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-h7h7-6mx3-r89v/GHSA-h7h7-6mx3-r89v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h7h7-6mx3-r89v

Aliases

RUSTSEC-2024-0435

Published

2025-02-14T17:31:16Z

Modified

2026-09-10T03:50:22Z

Summary

Fyrox has unsound usages of `Vec::from_raw_parts`

Details

The library provides a public safe API transmute_vec_as_bytes, which incorrectly assumes that any generic type T could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as T and cast it to u8 pointer.

In the issue, we develop a PoC to show passing struct type to transmute_vec_as_bytes could lead to undefined behavior with Vec::from_raw_parts.

The developers provide a patch by changing trait of Copy to Pod, which can make sure T should be plain data. This was patched in the latest version of master branch, but still not on the latest release (0.28.1).

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-02-14T17:31:16Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

crates.io / fyrox-core

Package

Name: fyrox-core; View open source insights on deps.dev
Purl: pkg:cargo/fyrox-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.28.1

Fixed

0.36

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-h7h7-6mx3-r89v/GHSA-h7h7-6mx3-r89v.json"