RUSTSEC-2023-0017

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2023-0017

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0017.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2023-0017

Aliases

GHSA-wm8x-php5-hvq6

Published

2023-03-04T12:00:00Z

Modified

2023-11-08T04:23:53.984745Z

Summary

`maligned::align_first` causes incorrect deallocation

Details

maligned::align_first manually allocates with an alignment larger than T, and then uses Vec::from_raw_parts on that allocation to get a Vec<T>.

<code>GlobalAlloc::dealloc</code> requires that the layout argument must be the same layout that was used to allocate that block of memory.

When deallocating, Box and Vec may not respect the specified alignment and can cause undefined behavior.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / maligned

Package

Name: maligned; View open source insights on deps.dev
Purl: pkg:cargo/maligned

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "maligned::align_first",
            "maligned::align_first_boxed",
            "maligned::align_first_boxed_cloned",
            "maligned::align_first_boxed_default"
        ],
        "os": []
    }
}

Database specific

informational

"unsound"

cvss

null