RUSTSEC-2021-0032

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2021-0032

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2021-0032.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2021-0032

Aliases

CVE-2021-28033
GHSA-8fgg-5v78-6g76

Published

2021-03-01T12:00:00Z

Modified

2023-11-08T04:05:27.850049Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Deserializing an array can drop uninitialized memory on panic

Details

The read_bytes_default_le function for [T; n] arrays, used to deserialize arrays of T from bytes created a [T; n] array with std::mem::uninitialized and then called T's deserialization method.

If T's deserialization method panicked, the uninitialized memory could drop invalid objects.

This flaw was corrected in a535678 by removing the unsafe block and using a .map function to deserialize each element of the array instead.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / byte_struct

Package

Name: byte_struct; View open source insights on deps.dev
Purl: pkg:cargo/byte_struct

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.6.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific

cvss

"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

informational

null