RUSTSEC-2022-0052

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2022-0052

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2022-0052.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2022-0052

Aliases

GHSA-c439-chv8-8g2j

Published

2022-08-26T12:00:00Z

Modified

2023-11-08T04:18:12.374709Z

Summary

`os_socketaddr` invalidly assumes the memory layout of std::net::SocketAddr

Details

The os_socketaddr crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation.

These layout were changed into idiomatic rust types in nightly std. Starting from rustc 1.64 the affected versions of this crate will have undefined behaviour.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / os_socketaddr

Package

Name: os_socketaddr; View open source insights on deps.dev
Purl: pkg:cargo/os_socketaddr

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.2.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific

{
    "cvss": null,
    "informational": "unsound",
    "categories": [
        "memory-corruption"
    ]
}