GHSA-pqpw-89w5-82v5
Suggest an improvement- Source
- https://github.com/advisories/GHSA-pqpw-89w5-82v5
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-pqpw-89w5-82v5/GHSA-pqpw-89w5-82v5.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-pqpw-89w5-82v5
- Published
- 2024-11-12T20:53:54Z
- Modified
- 2024-11-12T20:53:55Z
- Severity
-
- 6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator
- Summary
- `simd-json-derive` vulnerable to `MaybeUninit` misuse
- Details
-
An invalid use of
MaybeUninit::uninit().assume_init()insimd-json-derive's derive macro can cause undefined behavior. The original code usedMaybeUninitto avoid initialisation of the struct and then set the fields usingptr::write. The undefined behavior triggered by this misuse ofMaybeUninitcan lead to invlaid memory access and panics in binaries compiled in release mode (aka simd-json-derive prior to version 0.12 has UB and optimizes into some nonsense)The version
0.12.0removes this section of code, avoiding the use of MaybeUninit alltogether. - References
Affected packages
crates.io / simd-json-derive
Package
- Name
- simd-json-derive
- View open source insights on deps.dev
- Purl
- pkg:cargo/simd-json-derive