GHSA-qm2p-4w45-v2vr

Source

https://github.com/advisories/GHSA-qm2p-4w45-v2vr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-qm2p-4w45-v2vr/GHSA-qm2p-4w45-v2vr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qm2p-4w45-v2vr

Aliases

RUSTSEC-2025-0005

Published

2025-02-10T18:07:30Z

Modified

2025-10-28T06:29:25.945179Z

Summary

grcov has an out of bounds write triggered by crafted coverage data

Details

Function grcov::covdir::get_coverage uses the unsafe function get_unchecked_mut without validating that the index is in bounds.

This results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.

Database specific

{
    "github_reviewed_at": "2025-02-10T18:07:30Z",
    "nvd_published_at": null,
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-787"
    ],
    "github_reviewed": true
}

References

Affected packages

crates.io / grcov

Package

Name: grcov; View open source insights on deps.dev
Purl: pkg:cargo/grcov

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.8.20

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-qm2p-4w45-v2vr/GHSA-qm2p-4w45-v2vr.json"