RUSTSEC-2023-0017

See a problem?
Please try reporting it to the source first.
Source
https://rustsec.org/advisories/RUSTSEC-2023-0017
Import Source
https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0017.json
JSON Data
https://api.osv.dev/v1/vulns/RUSTSEC-2023-0017
Aliases
Published
2023-03-04T12:00:00Z
Modified
2023-11-08T04:23:53.984745Z
Summary
`maligned::align_first` causes incorrect deallocation
Details

maligned::align_first manually allocates with an alignment larger than T, and then uses Vec::from_raw_parts on that allocation to get a Vec<T>.

GlobalAlloc::dealloc requires that the layout argument must be the same layout that was used to allocate that block of memory.

When deallocating, Box and Vec may not respect the specified alignment and can cause undefined behavior.

Database specific 
{
    "license": "CC0-1.0"
}
References

Affected packages

crates.io / maligned

Package

Name
maligned
View open source insights on deps.dev
Purl
pkg:cargo/maligned

Affected ranges

Type
SEMVER
Events
Introduced
0.0.0-0

Ecosystem specific 

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [
            "maligned::align_first",
            "maligned::align_first_boxed",
            "maligned::align_first_boxed_cloned",
            "maligned::align_first_boxed_default"
        ],
        "arch": []
    }
}

Database specific 

{
    "cvss": null,
    "informational": "unsound",
    "categories": [
        "memory-corruption"
    ]
}