Описание
Versionize::deserialize implementation for FamStructWrapper is lacking bound checks, potentially leading to out of bounds memory accesses
Impact
An issue was discovered in the Versionize::deserialize implementation provided by the versionize crate for vmm_sys_util::fam::FamStructWrapper, which can lead to out of bounds memory accesses.
Patches
The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.
Workarounds
-
References
Ссылки
- https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc
- https://nvd.nist.gov/vuln/detail/CVE-2023-28448
- https://github.com/firecracker-microvm/versionize/pull/53
- https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47
- https://github.com/firecracker-microvm/versionize/releases/tag/v0.1.10
- https://rustsec.org/advisories/RUSTSEC-2023-0030.html
Пакеты
versionize
>= 0.1.1, < 0.1.10
0.1.10
Связанные уязвимости
Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.
Versionize is lacking bound checks potentially leading to out of bounds memory access