RUSTSEC-2026-0486

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0486

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0486.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0486

Aliases

GHSA-jh2m-fhpj-3vr7

Published

2026-10-27T12:00:00Z

Modified

2026-11-11T08:45:02Z

Summary

xattr functions mark unwritten bytes as initialized when given a zero-length buffer

Details

The extended-attribute functions in rustix::fs (getxattr, lgetxattr, fgetxattr, listxattr, llistxattr and flistxattr) write into a Buffer and then mark as many bytes initialized as the system call reported. When the buffer has zero length, the operating system treats the call as a size query: it writes nothing and returns the size of the attribute value or of the name list. rustix still marked that many bytes as initialized.

Passing a Vec whose length equals its capacity through spare_capacity gives such a zero-length buffer, and rustix then set the vector's length past its capacity over memory that was never written. This is undefined behavior reachable from safe code. With an empty &mut [MaybeUninit<u8>] the call panics instead.

From 1.1.6 these functions return an empty result for a zero-length buffer, and new getxattr_query, lgetxattr_query, fgetxattr_query, listxattr_query, llistxattr_query and flistxattr_query functions return the size. The 0.38 series did not have the Buffer API and is not affected.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / rustix

Package

Name: rustix; View open source insights on deps.dev
Purl: pkg:cargo/rustix

Affected ranges

Type: SEMVER
Events: Introduced

1.0.0

Fixed

1.1.6

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "rustix::fs::fgetxattr",
            "rustix::fs::flistxattr",
            "rustix::fs::getxattr",
            "rustix::fs::lgetxattr",
            "rustix::fs::listxattr",
            "rustix::fs::llistxattr"
        ],
        "os": []
    }
}