GHSA-8vxc-r5wp-vgvcMediumCVSS 5.7

Versionize::deserialize implementation for FamStructWrapper<T> is lacking bound checks, potentially leading to out of bounds memory accesses

Published
March 24, 2023
Last Modified
March 27, 2023

🔗 CVE IDs covered (1)

CVE-2023-28448 →

📋 Description

Impact

An issue was discovered in the Versionize::deserialize implementation provided by the versionize crate for vmm_sys_util::fam::FamStructWrapper, which can lead to out of bounds memory accesses.

Patches

The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.

Workarounds

-

References

  • https://github.com/firecracker-microvm/versionize/pull/53

🎯 Affected products1

  • rust/versionize:>= 0.1.1, < 0.1.10

🔗 References (7)